Trust Assessment
solana received a trust score of 51/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Remote code execution: curl/wget pipe to shell, Unpinned Remote Script Execution During Installation, Unpinned Third-Party Tool Installation (Metaboss).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Remote code execution: curl/wget pipe to shell Detected a pattern that downloads and immediately executes remote code. This is a primary malware delivery vector. Never pipe curl/wget output directly to a shell interpreter. | Static | skills/sakaen736jih/solana/SKILL.md:8 | |
| HIGH | Unpinned Remote Script Execution During Installation The skill's installation command directly downloads and executes a shell script from a remote URL (`https://release.solana.com/stable/install`) without any version pinning or integrity checks (e.g., checksum verification). This poses a significant supply chain risk, as a compromise of the remote server could lead to arbitrary code execution on the user's system during skill installation. Pin the installation script to a specific version or commit hash. Implement cryptographic verification (e.g., checksums) for downloaded scripts. Consider using a package manager that provides integrity checks or distributing a pre-compiled binary. | LLM | Manifest | |
| MEDIUM | Unpinned Third-Party Tool Installation (Metaboss) The skill documentation recommends installing 'metaboss' using `cargo install metaboss`. This command fetches and compiles the latest version of the 'metaboss' package from crates.io. Without specifying a version or verifying the package's integrity, this introduces a supply chain risk. A malicious update to the 'metaboss' package or a compromise of crates.io could lead to the execution of untrusted code. Recommend installing a specific, known-good version of 'metaboss' (e.g., `cargo install metaboss --version X.Y.Z`). Provide instructions for verifying the package's integrity, such as checking a known checksum or signature, or consider distributing a pre-compiled binary with checksums. | LLM | SKILL.md:66 |
Scan History
Embed Code
[](https://skillshield.io/report/8414d5815b1a7bad)
Powered by SkillShield