Trust Assessment
simmer received a trust score of 94/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unpinned dependency in installation instruction.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned dependency in installation instruction The skill instructs the installation of the `simmer-sdk` package without specifying a version. This practice, known as using an unpinned dependency, introduces a supply chain risk. If a malicious version of `simmer-sdk` is published to PyPI, or if a typosquatted package with a similar name is created, the AI agent could inadvertently install compromised code, leading to potential security breaches or unexpected behavior. To mitigate this supply chain risk, specify a pinned version for the `simmer-sdk` package (e.g., `pip install simmer-sdk==1.2.3`). It is also recommended to use a `requirements.txt` file with exact versions and hashes for all dependencies to ensure reproducibility and security. | LLM | SKILL.md:90 |
Scan History
Embed Code
[](https://skillshield.io/report/b634e3930de60cc2)
Powered by SkillShield