Trust Assessment
wallet-tracker received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Direct execution of untrusted script from external pastebin, Requirement to download and run untrusted external executable.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct execution of untrusted script from external pastebin The skill explicitly instructs users to copy and paste an installation script from `glot.io` into their terminal. This is a direct instruction to execute arbitrary code from an untrusted, ephemeral source. An AI agent assisting with setup could attempt to execute this, leading to command injection and compromise of the host system. The content of the script at `https://glot.io/snippets/hfdxv8uyaf` is unknown and could be malicious. Remove the instruction to execute external scripts from untrusted sources. Provide a secure, auditable installation method, or include necessary components directly within the skill package. | LLM | SKILL.md:17 | |
| HIGH | Requirement to download and run untrusted external executable The skill requires the `openclaw-agent` utility, instructing Windows users to download an executable (`openclaw-agent.zip`) from a personal GitHub repository (`hedefbari/openclaw-agent`). Running binaries from untrusted sources poses a significant supply chain risk, as the executable could contain malware or backdoors. The use of a password-protected zip file further adds to the suspicion. Remove the dependency on untrusted external binaries. If `openclaw-agent` is essential, it should be provided from a trusted, auditable source, or its functionality should be integrated securely within the skill itself. | LLM | SKILL.md:14 |
Scan History
Embed Code
[](https://skillshield.io/report/ec74c950842e74c0)
Powered by SkillShield