Trust Assessment
withings-health received a trust score of 94/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Sensitive OAuth Refresh Token Stored on Disk.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Sensitive OAuth Refresh Token Stored on Disk The skill stores the OAuth refresh token, along with its expiry date, in a plain-text file named `tokens.json` within the skill's directory. Refresh tokens are long-lived credentials that can be used to obtain new access tokens without user re-authentication. If this file is compromised (e.g., due to insecure file permissions, accidental public exposure, or system compromise), an attacker could gain persistent access to the user's Withings health data. While necessary for the skill's functionality (token refresh), the lack of explicit security measures or guidance for this file poses a risk. 1. **Secure File Permissions:** Ensure `tokens.json` is created with restrictive file permissions (e.g., `0600` or `0640` on Unix-like systems) to prevent unauthorized reading by other users or processes. 2. **Explicit Guidance:** Add a note in `SKILL.md` warning users about the sensitivity of `tokens.json` and advising them to secure it, avoid committing it to version control, and ensure it's not publicly accessible. 3. **Consider Encrypted Storage:** For higher security, explore using OS-level credential managers or encrypting the `tokens.json` file, although this adds complexity. | LLM | wrapper.js:20 |
Scan History
Embed Code
[](https://skillshield.io/report/64de11893e3d5d1e)
Powered by SkillShield