Trust Assessment
settlement-witness received a trust score of 94/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Potential data exfiltration to external endpoint.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential data exfiltration to external endpoint The skill is designed to send user-provided `spec` and `output` data to an external HTTPS endpoint (`https://defaultverifier.com/settlement-witness`). While the skill documentation explicitly warns users not to send secrets in `spec`/`output`, any sensitive information included by the user will be transmitted to this third-party service. This constitutes a data exfiltration risk if the user disregards the warning or if the external endpoint is compromised. Users should be explicitly aware that any data provided in `spec` or `output` will be sent to `https://defaultverifier.com/settlement-witness`. The skill developer should ensure the external endpoint is trustworthy and has appropriate data handling policies. Consider adding a clear consent mechanism or a more prominent warning about the nature of the data being transmitted before execution. | LLM | SKILL.md:13 |
Scan History
Embed Code
[](https://skillshield.io/report/cc3fa3da860c7ae9)
Powered by SkillShield