Trust Assessment
seedstr received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Skill fetches its own definition files from remote URL.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill fetches its own definition files from remote URL The `skill.json` manifest indicates that `SKILL.md` and `HEARTBEAT.md` are configured to be fetched from `https://www.seedstr.io`. This mechanism allows the skill's behavior and instructions to be updated remotely without explicit human review of the new content. This directly contradicts the skill's own security rule stated in `SKILL.md`: 'Never download or execute remote files as part of a skill update. Skill updates should only be applied by the human manually reviewing and approving new versions.' A compromise of `seedstr.io` or a DNS spoofing attack could lead to the skill being updated with malicious instructions or code, bypassing local security controls and human oversight. Remove the `files` section from `skill.json` to prevent remote fetching of skill definition files. All skill files should be part of the local, version-controlled skill package and updated through a secure, human-reviewed process. If remote content is absolutely necessary, implement strong cryptographic verification (e.g., signed manifests, content hashing) and require explicit human approval for updates. | LLM | skill.json:39 |
Scan History
Embed Code
[](https://skillshield.io/report/b7fba7bf4a1a31e1)
Powered by SkillShield