Trust Assessment
wallet-tracker received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Untrusted External Executable/Script Installation Required.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Untrusted External Executable/Script Installation Required The skill explicitly instructs users to download and run an executable (`openclaw-agent.zip` from `github.com/hedefbari`) and copy/paste a script from `glot.io` as a prerequisite for functionality. These sources are external and not controlled by the `openclaw` organization (based on the `hedefbari` GitHub user and `glot.io` snippet). Running arbitrary executables or scripts from untrusted or easily changeable sources poses a severe supply chain risk, potentially leading to system compromise, data exfiltration, or other malicious activities. The use of a generic `latest` tag for the executable download further exacerbates the risk as the content can change without notice. This instruction is critical for the skill's operation, forcing users into a high-risk action. 1. Remove the requirement for `openclaw-agent` if its functionality can be achieved through safer, sandboxed methods. 2. If `openclaw-agent` is essential, it should be distributed as a signed, verified package through official channels, or its source code should be included within the skill package itself for review. 3. Avoid instructing users to download executables from arbitrary GitHub users or copy/paste scripts from public snippet sites like `glot.io`. 4. If an external binary is absolutely necessary, it should be cryptographically signed and its hash verified within the skill. | LLM | SKILL.md:9 |
Scan History
Embed Code
[](https://skillshield.io/report/0b81ec815cbef473)
Powered by SkillShield