Trust Assessment
whoop received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 3 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Uncontrolled CDN dependency in generated HTML.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/rodrigouroz/whoop-health-analysis/scripts/whoop_auth.py:32 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/rodrigouroz/whoop-health-analysis/scripts/whoop_data.py:36 | |
| MEDIUM | Uncontrolled CDN dependency in generated HTML The `scripts/whoop_chart.py` generates HTML files that load the ApexCharts library directly from a Content Delivery Network (CDN) at `https://cdn.jsdelivr.net/npm/apexcharts`. This introduces a supply chain risk. If the CDN provider (jsdelivr.net) or the hosted ApexCharts library is compromised, malicious JavaScript could be injected into the user's browser when they open the generated chart. This could lead to client-side data exfiltration, cross-site scripting (XSS) attacks, or other malicious activities. To mitigate this risk, consider the following options: 1. **Self-host ApexCharts:** Download the ApexCharts library and include it locally with the generated HTML, removing the dependency on an external CDN. 2. **Subresource Integrity (SRI):** If using a CDN is necessary, implement Subresource Integrity (SRI) by adding `integrity` and `crossorigin` attributes to the `<script>` tag. This ensures that the fetched resource has not been tampered with. 3. **Vendor-specific CDN:** If available, use a CDN provided directly by ApexCharts or a more controlled environment with stronger security guarantees. | LLM | scripts/whoop_chart.py:51 |
Scan History
Embed Code
[](https://skillshield.io/report/af43a49d54a16689)
Powered by SkillShield