Trust Assessment
spots received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unpinned dependency in installation instructions, Skill requires sensitive API key for operation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned dependency in installation instructions The skill's documentation suggests installing the `spots` binary using `go install github.com/foeken/spots@latest`. Relying on `@latest` means the skill depends on the most recent version of the upstream repository, which can change at any time without review. This introduces a significant supply chain risk, as a malicious update to the `foeken/spots` repository could lead to arbitrary code execution during installation or subsequent use, compromising the system. Pin the dependency to a specific, immutable version (e.g., a commit hash or a semantic version tag like `@v1.2.3`) to ensure reproducible and secure installations. This prevents unexpected changes or malicious code from being introduced. | LLM | SKILL.md:7 | |
| INFO | Skill requires sensitive API key for operation The skill requires a `GOOGLE_PLACES_API_KEY` with Places API and Geocoding API enabled for its functionality. The documentation suggests storing this key in 1Password. While 1Password is a secure storage solution, the skill's actual implementation (not provided in this context) will need to securely access and utilize this key. Insecure handling (e.g., logging, hardcoding, or transmitting it unencrypted) could lead to credential exposure and unauthorized access to Google services. Ensure the skill's code accesses the API key securely, preferably from environment variables or a dedicated secrets manager, and avoids logging, hardcoding, or transmitting it insecurely. Implement least privilege access for the key and ensure it's never exposed in logs or error messages. | LLM | SKILL.md:34 |
Scan History
Embed Code
[](https://skillshield.io/report/ea960e6cfea9fa71)
Powered by SkillShield