Trust Assessment
quiver received a trust score of 100/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 0 medium, and 0 low severity. Key findings include Unspecified Third-Party Dependency Version.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| INFO | Unspecified Third-Party Dependency Version The skill imports the 'quiverquant' library without specifying a version or pinning it in a 'requirements.txt' or similar file. This can lead to supply chain risks, where a malicious update to the library could introduce vulnerabilities, or a different version could cause unexpected behavior. It also makes the build non-deterministic. Pin the version of 'quiverquant' and all other third-party dependencies in a 'requirements.txt' file or 'pyproject.toml'. For example, 'quiverquant==X.Y.Z'. Ensure the dependency is from a trusted source. | LLM | scripts/query_quiver.py:4 |
Scan History
Embed Code
[](https://skillshield.io/report/dadb951b75a88a87)
Powered by SkillShield