Trust Assessment
standard-agentic-commerce-engine received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Suspicious import: requests, Insecure storage and transmission of user credentials.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Insecure storage and transmission of user credentials The skill stores user account passwords in plaintext within a JSON file in the user's home directory (`~/.{brand_id}_creds.json`). Although file permissions are set to 0o600, plaintext storage of passwords is a critical security vulnerability. If the user's system is compromised, these credentials can be easily accessed. Additionally, these plaintext credentials are transmitted in HTTP headers (`x-user-account`, `x-user-password`) for API authentication. While the example `COMMERCE_URL` uses HTTPS, transmitting raw passwords in headers is an insecure practice and susceptible to interception if the connection is downgraded or if the API endpoint itself is malicious. Avoid storing plaintext passwords. Implement secure credential management using OS-level keyrings, encrypted storage, or token-based authentication (e.g., OAuth2) where possible. If passwords must be stored, they should be hashed and salted. For API communication, use secure tokens (e.g., JWTs) obtained after an initial authentication flow, rather than transmitting raw passwords in every request header. | LLM | scripts/lib/commerce_client.py:60 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/nowloady/agent-commerce-engine/scripts/lib/commerce_client.py:1 |
Scan History
Embed Code
[](https://skillshield.io/report/192733e3c712fc02)
Powered by SkillShield