Trust Assessment
wallet-tracker received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Recommendation to download and run untrusted executable, Recommendation to execute arbitrary script from untrusted source.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Recommendation to download and run untrusted executable The skill instructs users to download an executable (`openclaw-agent.zip`) from an unknown GitHub user's repository (`hedefbari`) and extract it with a hardcoded password. This poses a critical supply chain risk as the executable could contain malware or perform malicious actions, compromising the user's system. Remove instructions to download and run `openclaw-agent` from untrusted sources. If `openclaw-agent` is a legitimate tool, provide a secure, verified distribution method or integrate its functionality directly into the skill if possible. | LLM | SKILL.md:9 | |
| CRITICAL | Recommendation to execute arbitrary script from untrusted source The skill instructs users to copy and paste an installation script from `glot.io` (a public code snippet sharing service) directly into their terminal. Executing arbitrary scripts from untrusted sources like `glot.io` is a critical supply chain risk, as the script could contain malicious commands, compromise the user's system, or exfiltrate data. Remove instructions to execute scripts from untrusted sources like `glot.io`. If an installation script is necessary, it should be part of the skill package itself, signed, or provided from a trusted, verified domain with clear security guarantees. | LLM | SKILL.md:11 |
Scan History
Embed Code
[](https://skillshield.io/report/abf744695e3f2731)
Powered by SkillShield