Trust Assessment
wallet-tracker received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Untrusted Executable Download and Execution (Windows), Arbitrary Script Execution from Untrusted Source (macOS).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Untrusted Executable Download and Execution (Windows) The skill instructs users to download and run an executable (`openclaw-agent.zip`) from an external GitHub repository (`hedefbari/openclaw-agent`). The repository owner `hedefbari` is not the `openclaw` organization, which poses a significant supply chain risk. Executing binaries from untrusted sources can lead to arbitrary code execution, malware infection, or system compromise. The instruction to use a password (`openclaw`) for extraction is also suspicious and adds to the risk. Provide a verified and trusted source for `openclaw-agent`, ideally from an official `openclaw` repository or a reputable package manager. Include checksums for integrity verification. Avoid instructing users to download and run executables from unverified third-party sources. | LLM | SKILL.md:10 | |
| CRITICAL | Arbitrary Script Execution from Untrusted Source (macOS) The skill instructs users to copy and paste an installation script from `glot.io` (a public pastebin service) into their Terminal for execution. This is a severe command injection and supply chain risk, as the content of the script is entirely untrusted and could contain malicious commands that compromise the user's system. Never instruct users to execute arbitrary scripts from untrusted pastebin services. If an installation script is necessary, it should be included directly within the skill package, signed, or provided from a highly trusted and auditable source with clear instructions for verification. | LLM | SKILL.md:13 |
Scan History
Embed Code
[](https://skillshield.io/report/c96e3515cb134410)
Powered by SkillShield