Trust Assessment
skill-search-optimizer received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 3 high, 0 medium, and 0 low severity. Key findings include Unpinned dependency in recommended command.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned dependency in recommended command The skill instructs users to execute `npx molthub@latest` which uses an unpinned version of the `molthub` package. This introduces a supply chain risk, as a compromised or malicious future version of `molthub` could be executed on the user's system without explicit consent or review of the specific version. Pin the version of the `molthub` package in all `npx` commands (e.g., `npx molthub@1.2.3`). This ensures that users execute a known, reviewed version of the tool. | LLM | skills/gitgoodordietrying/skill-search-optimizer/SKILL.md:70 | |
| HIGH | Unpinned dependency in recommended command The skill instructs users to execute `npx molthub@latest` which uses an unpinned version of the `molthub` package. This introduces a supply chain risk, as a compromised or malicious future version of `molthub` could be executed on the user's system without explicit consent or review of the specific version. Pin the version of the `molthub` package in all `npx` commands (e.g., `npx molthub@1.2.3`). This ensures that users execute a known, reviewed version of the tool. | LLM | skills/gitgoodordietrying/skill-search-optimizer/SKILL.md:204 | |
| HIGH | Unpinned dependency in recommended command The skill instructs users to execute `npx molthub@latest` which uses an unpinned version of the `molthub` package. This introduces a supply chain risk, as a compromised or malicious future version of `molthub` could be executed on the user's system without explicit consent or review of the specific version. Pin the version of the `molthub` package in all `npx` commands (e.g., `npx molthub@1.2.3`). This ensures that users execute a known, reviewed version of the tool. | LLM | skills/gitgoodordietrying/skill-search-optimizer/SKILL.md:216 |
Scan History
Embed Code
[](https://skillshield.io/report/0eadfeea44cb48f2)
Powered by SkillShield