Trust Assessment
wheels-router received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Unpinned `npx` dependency in client configuration.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned `npx` dependency in client configuration The skill's documentation instructs users to configure their Claude Desktop client to execute `npx mcp-remote https://mcp.justusewheels.com/mcp`. The `mcp-remote` package is not pinned to a specific version, meaning `npx` will always fetch and execute the latest version from npm. This introduces a supply chain risk, as a compromise of the `mcp-remote` package on npm could lead to arbitrary code execution on the user's machine when they set up the skill. Pin the `mcp-remote` package to a specific, known-good version (e.g., `npx mcp-remote@1.2.3 ...`) to mitigate the risk of executing compromised code. | LLM | SKILL.md:62 | |
| HIGH | Unpinned `npx` dependency in client configuration The skill's documentation instructs users to configure their Cursor/Windsurf/VS Code client to execute `npx mcp-remote https://mcp.justusewheels.com/mcp`. The `mcp-remote` package is not pinned to a specific version, meaning `npx` will always fetch and execute the latest version from npm. This introduces a supply chain risk, as a compromise of the `mcp-remote` package on npm could lead to arbitrary code execution on the user's machine when they set up the skill. Pin the `mcp-remote` package to a specific, known-good version (e.g., `npx mcp-remote@1.2.3 ...`) to mitigate the risk of executing compromised code. | LLM | SKILL.md:71 |
Scan History
Embed Code
[](https://skillshield.io/report/58f1f1e332560430)
Powered by SkillShield