Trust Assessment
solflare received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned remote script execution for Solana CLI installation, Unpinned `cargo install` command for `metaboss`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned remote script execution for Solana CLI installation The skill's installation manifest executes a shell script directly downloaded from a remote URL (`https://release.solana.com/stable/install`) without pinning to a specific version or cryptographic hash. This introduces a significant supply chain risk, as a compromise of the remote server or the script itself could lead to the execution of malicious code during skill installation. Pin the installation script to a specific version or cryptographic hash. Alternatively, provide instructions for manual review and installation, or use a package manager that verifies integrity. | LLM | SKILL.md | |
| MEDIUM | Unpinned `cargo install` command for `metaboss` The skill documentation suggests installing `metaboss` using `cargo install metaboss`. By default, `cargo install` fetches the latest version from `crates.io`, which can introduce a supply chain risk if a malicious update or a typosquat package is published. Users following this instruction could unknowingly install compromised software. Recommend installing a specific, known-good version of `metaboss` (e.g., `cargo install metaboss --version X.Y.Z`) or provide instructions for verifying the package's integrity before installation. | LLM | SKILL.md:90 |
Scan History
Embed Code
[](https://skillshield.io/report/f39dd39a9a84642e)
Powered by SkillShield