Trust Assessment
spawn-incubator received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential information disclosure via public application API.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential information disclosure via public application API The skill describes an API endpoint `GET https://spawn.fund/api/applications/:id` which is stated to return "Full details for an application". The application schema, which would be returned by this endpoint, includes sensitive information such as `name`, `description`, `market`, `revenue_model`, `milestones`, `funding_request`, `agent_capabilities`, and `projected_revenue`. If this endpoint is publicly accessible without robust authentication and authorization, an attacker could enumerate application IDs and exfiltrate detailed business plans, funding requests, and specific agent capabilities (tools, APIs, models) of other applicants. This could lead to competitive disadvantages, intellectual property theft, or other forms of information leakage. Implement robust authentication and authorization checks for the `/api/applications/:id` endpoint to ensure that only the owner of an application or authorized personnel can access its full details. Consider redacting sensitive fields for public consumption or providing a separate, restricted endpoint for full details. | LLM | SKILL.md:108 |
Scan History
Embed Code
[](https://skillshield.io/report/f066465b71f8f1b1)
Powered by SkillShield