Trust Assessment
scout-commerce received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 15 findings: 0 critical, 0 high, 15 medium, and 0 low severity. Key findings include Suspicious import: requests, Suspicious import: urllib.request, Unpinned Python dependency version.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 51/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings15
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/xasus1/scout-commerce/scripts/balance.py:16 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/xasus1/scout-commerce/scripts/buy.py:21 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/xasus1/scout-commerce/scripts/get_api_key.py:21 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/xasus1/scout-commerce/scripts/order_status.py:19 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/xasus1/scout-commerce/scripts/product.py:16 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/xasus1/scout-commerce/scripts/search.py:16 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/xasus1/scout-commerce/scripts/swap.py:19 | |
| MEDIUM | Unpinned Python dependency version Requirement 'x402[httpx,svm]>=2.0.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/xasus1/scout-commerce/scripts/requirements.txt:5 | |
| MEDIUM | Unpinned Python dependency version Requirement 'solana>=0.34.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/xasus1/scout-commerce/scripts/requirements.txt:8 | |
| MEDIUM | Unpinned Python dependency version Requirement 'solders>=0.21.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/xasus1/scout-commerce/scripts/requirements.txt:9 | |
| MEDIUM | Unpinned Python dependency version Requirement 'base58>=2.1.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/xasus1/scout-commerce/scripts/requirements.txt:12 | |
| MEDIUM | Loosely Pinned Dependencies The `requirements.txt` file uses loose version pinning (e.g., `>=2.0.0`) instead of exact pinning (e.g., `==2.0.0`). This can lead to unexpected behavior, compatibility issues, or the introduction of vulnerabilities if a new version of a dependency contains breaking changes or security flaws. While not strictly 'unpinned', it's a weaker pinning strategy. Pin all dependencies to exact versions (e.g., `package==1.2.3`) to ensure deterministic builds and prevent unexpected changes from upstream packages. Use a tool like `pip-compile` or `pip freeze > requirements.txt` after verifying all dependencies. | LLM | scripts/requirements.txt:4 | |
| MEDIUM | Loosely Pinned Dependencies The `requirements.txt` file uses loose version pinning (e.g., `>=0.34.0`) instead of exact pinning (e.g., `==0.34.0`). This can lead to unexpected behavior, compatibility issues, or the introduction of vulnerabilities if a new version of a dependency contains breaking changes or security flaws. While not strictly 'unpinned', it's a weaker pinning strategy. Pin all dependencies to exact versions (e.g., `package==1.2.3`) to ensure deterministic builds and prevent unexpected changes from upstream packages. Use a tool like `pip-compile` or `pip freeze > requirements.txt` after verifying all dependencies. | LLM | scripts/requirements.txt:7 | |
| MEDIUM | Loosely Pinned Dependencies The `requirements.txt` file uses loose version pinning (e.g., `>=0.21.0`) instead of exact pinning (e.g., `==0.21.0`). This can lead to unexpected behavior, compatibility issues, or the introduction of vulnerabilities if a new version of a dependency contains breaking changes or security flaws. While not strictly 'unpinned', it's a weaker pinning strategy. Pin all dependencies to exact versions (e.g., `package==1.2.3`) to ensure deterministic builds and prevent unexpected changes from upstream packages. Use a tool like `pip-compile` or `pip freeze > requirements.txt` after verifying all dependencies. | LLM | scripts/requirements.txt:8 | |
| MEDIUM | Loosely Pinned Dependencies The `requirements.txt` file uses loose version pinning (e.g., `>=2.1.0`) instead of exact pinning (e.g., `==2.1.0`). This can lead to unexpected behavior, compatibility issues, or the introduction of vulnerabilities if a new version of a dependency contains breaking changes or security flaws. While not strictly 'unpinned', it's a weaker pinning strategy. Pin all dependencies to exact versions (e.g., `package==1.2.3`) to ensure deterministic builds and prevent unexpected changes from upstream packages. Use a tool like `pip-compile` or `pip freeze > requirements.txt` after verifying all dependencies. | LLM | scripts/requirements.txt:11 |
Scan History
Embed Code
[](https://skillshield.io/report/9dfc47fb2078679b)
Powered by SkillShield