Security Audit

Shaivpidadi/FreeRide:root

github.com/Shaivpidadi/FreeRide

AI SkillCommit 7b3bb7b2b0ae

CAUTION

Scanned 2 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

Shaivpidadi/FreeRide:root received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 4 findings: 0 critical, 0 high, 4 medium, and 0 low severity. Key findings include Suspicious import: requests, Unpinned Python dependency version, Unpinned dependency in install script.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on April 5, 2026 (commit 7b3bb7b2). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

79%

Dependency Graph

93%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Network Access

3 findings

Shell Execution

1 finding

Excessive Permissions

2 findings

Security Findings4

Severity	Finding	Layer	Location
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	main.py:18
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	watcher.py:18
MEDIUM	Unpinned Python dependency version Requirement 'requests>=2.31.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	requirements.txt:1
MEDIUM	Unpinned dependency in install script The `install` command in `skill.json` uses `npx clawhub@latest install free-ride`. Using `@latest` for a package in an install script means that the exact version of `clawhub` is not pinned. This introduces a supply chain risk, as a malicious update to `clawhub` could be automatically pulled and executed during the skill's installation, potentially compromising the system. Pin the version of `clawhub` used in the install script to a specific, known-good version (e.g., `npx clawhub@1.2.3 install free-ride`). Regularly review and update the pinned version to benefit from security patches while maintaining control over dependencies.	Static	skill.json:40

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/f7f8841fd9f59aa7.svg)](https://skillshield.io/report/f7f8841fd9f59aa7)