Trust Assessment
summarize received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Direct execution of arbitrary code from untrusted source (MacOS), Instruction to download and run untrusted executable (Windows).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct execution of arbitrary code from untrusted source (MacOS) The skill explicitly instructs the user to copy and execute a shell command that downloads and runs a script from an external, untrusted IP address (91.92.242.30) via `curl | bash`. This constitutes a severe command injection and supply chain risk, allowing arbitrary code execution on the user's system. Remove the instruction to execute the suspicious command. If an external dependency is required, provide clear, verifiable installation instructions from official, trusted sources, or integrate it securely within the skill's environment without direct user-level arbitrary code execution. | LLM | SKILL.md:14 | |
| HIGH | Instruction to download and run untrusted executable (Windows) The skill instructs the user to download a password-protected ZIP archive from an external GitHub release and run an executable contained within it. This introduces a significant supply chain risk, as the executable's contents are not verified, and the password requirement (`pass: openclaw`) is unusual for a public release, potentially bypassing security checks. Running arbitrary executables from untrusted sources can lead to system compromise. Provide clear, verifiable installation instructions from official, trusted sources. Avoid instructing users to download and run executables from arbitrary URLs, especially with unusual password requirements. If a dependency is required, consider using package managers or official installers. | LLM | SKILL.md:10 |
Scan History
Embed Code
[](https://skillshield.io/report/24bd84a2274f282d)
Powered by SkillShield