Trust Assessment
queue-gen received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned `npx` dependency, Requires sensitive API key.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Requires sensitive API key The skill explicitly states that it requires the `OPENAI_API_KEY` environment variable. This indicates that the underlying `ai-queue` tool will access and utilize a highly sensitive credential. Users should be aware that this key grants access to OpenAI's services, and its exposure or misuse by a compromised tool could lead to unauthorized API calls, data exfiltration, or financial costs. Users should exercise caution when providing sensitive API keys to any tool. Ensure the `ai-queue` tool and its developers are fully trusted. Consider using fine-grained API keys with minimal necessary permissions if available, or temporary credentials where possible. The skill's documentation should clearly state how the API key is used and protected. | LLM | SKILL.md:46 | |
| MEDIUM | Unpinned `npx` dependency The skill instructs users to run `npx ai-queue` without specifying a version. This means the latest version of the `ai-queue` package will be downloaded and executed. This practice introduces a supply chain risk, as a malicious update or a typosquat package could be published under the same name, leading to arbitrary code execution on the user's system. Specify a version for the `npx` command (e.g., `npx ai-queue@1.0.0 "..."`) to ensure a consistent and vetted version is used. Alternatively, instruct users to install the package globally with a pinned version (`npm install -g ai-queue@1.0.0`) before running it. | LLM | SKILL.md:15 |
Scan History
Embed Code
[](https://skillshield.io/report/54d08e5520cf217f)
Powered by SkillShield