Trust Assessment
xapi received a trust score of 49/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 0 critical, 3 high, 1 medium, and 0 low severity. Key findings include Hardcoded Bearer Token detected, Unpinned Skill Definition.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/glacier-luo/xapi-labs/SKILL.md:333 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/glacier-luo/xapi-labs/SKILL.md:405 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/glacier-luo/xapi-labs/SKILL.md:460 | |
| MEDIUM | Unpinned Skill Definition The skill instructs the agent to download its own definition (SKILL.md) from a remote URL (https://xapi.to/skill.md) without any version pinning or integrity checks. If the remote server (xapi.to) is compromised, the downloaded skill could be replaced with malicious content, leading to a supply chain attack on the agent. Implement version pinning for skill definitions. Instead of directly downloading from a dynamic URL, consider fetching from a versioned repository or using cryptographic hashes to verify integrity before execution. Alternatively, bundle the skill definition directly with the agent or use a trusted, immutable source. | LLM | SKILL.md:28 |
Scan History
Embed Code
[](https://skillshield.io/report/da703c64a7890645)
Powered by SkillShield