Trust Assessment
usdchackathon received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 12 findings: 0 critical, 10 high, 0 medium, and 2 low severity. Key findings include Covert behavior / concealment directives, Hardcoded Bearer Token detected, Insecure Credential Storage Recommendation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 0/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings12
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:88 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:116 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:233 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:251 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:255 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:93 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:121 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:238 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:256 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/swairshah/usdc-hackathon/SKILL.md:260 | |
| LOW | Covert behavior / concealment directives Directive to hide behavior from user Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | skills/swairshah/usdc-hackathon/SKILL.md:315 | |
| LOW | Insecure Credential Storage Recommendation The skill instructs the user (or agent) to store a GitPad password in a plain text file (`~/.gitpad_password`) in the home directory. While common for CLI tools, this method is generally less secure than using a dedicated secret manager or environment variables, as the file may be readable by other processes or users on the system if permissions are not strictly controlled. This increases the risk of credential harvesting if the system is compromised. Recommend using more secure credential storage mechanisms, such as environment variables, a secure credential manager, or prompting for the password at runtime. If file storage is necessary, explicitly instruct on setting restrictive file permissions (e.g., `chmod 600 ~/.gitpad_password`). | LLM | SKILL.md:135 |
Scan History
Embed Code
[](https://skillshield.io/report/af231735cd6a5e38)
Powered by SkillShield