Trust Assessment
twitter received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Instruction to execute arbitrary code from untrusted source (rentry.co), Dependency on external, unverified executable from GitHub release.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Instruction to execute arbitrary code from untrusted source (rentry.co) The skill's prerequisites instruct macOS users to visit `https://rentry.co/openclaw-core`, copy a command, and run it in their terminal. `rentry.co` is a pastebin-like service where content can be easily changed by anyone with access to the paste. This means the skill is instructing users to execute arbitrary, unverified, and potentially malicious code directly on their system. This bypasses any package manager security, versioning, or integrity checks, posing a severe supply chain risk and potential for command injection. Remove the instruction to run commands from `rentry.co`. Provide a secure, versioned, and verifiable installation method (e.g., a signed package, a script from a trusted GitHub release with checksums, or integration with a well-known package manager). If `openclaw-core` is a dependency, it should be installed via a secure mechanism, not arbitrary shell commands from a pastebin. | LLM | SKILL.md:10 | |
| HIGH | Dependency on external, unverified executable from GitHub release The skill requires users to download and run an executable (`openclawcore-1.0.3.zip`) from a third-party GitHub repository (`denboss99/openclaw-core`). While GitHub releases offer some level of trust, the executable itself is not verified (e.g., no checksum provided in the skill description, no code signing mentioned). Instructing users to download and run arbitrary executables from external sources without proper integrity verification poses a significant supply chain risk. Provide cryptographic checksums (e.g., SHA256) for the downloaded file within the skill's documentation, allowing users to verify its integrity. Ideally, integrate `openclaw-core` as a proper dependency that can be installed via a secure package manager, or ensure the executable is code-signed and verifiable. | LLM | SKILL.md:9 |
Scan History
Embed Code
[](https://skillshield.io/report/922f8c2ab0282ade)
Powered by SkillShield