Security Audit
dkyazzentwatwa/chatgpt-skills:gantt-chart-creator
github.com/dkyazzentwatwa/chatgpt-skillsTrust Assessment
dkyazzentwatwa/chatgpt-skills:gantt-chart-creator received a trust score of 35/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 7 findings: 0 critical, 2 high, 5 medium, and 0 low severity. Key findings include Unpinned Python dependency version, Arbitrary File Read via Unsanitized Input Path, Arbitrary File Write via Unsanitized Output Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Dependency Graph layer scored lowest at 65/100, indicating areas for improvement.
Last analyzed on February 24, 2026 (commit d4bad335). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings7
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Read via Unsanitized Input Path The `from_csv` method in `GanttChartCreator` directly uses a user-provided `filepath` to read a CSV file. If an untrusted input for `filepath` contains path traversal sequences (e.g., `../../`), an attacker could read the contents of arbitrary files on the filesystem. While the skill's primary purpose is to process this data for charting, the ability to read any file constitutes an information disclosure risk. Sanitize the `filepath` argument to prevent path traversal. This can be done by resolving the path to an absolute path within a designated safe directory (e.g., a temporary directory or a user-specific input directory) or by validating that the path does not contain `..` segments and is within an allowed base directory. | Static | scripts/gantt_creator.py:137 | |
| HIGH | Arbitrary File Write via Unsanitized Output Path The `save` method in `GanttChartCreator` directly uses a user-provided `filepath` for writing output files (`.png`, `.svg`, `.pdf`, `.html`). If an untrusted input for `filepath` contains path traversal sequences (e.g., `../../`), an attacker could write files to arbitrary locations on the filesystem, potentially overwriting critical system files or placing malicious content in web-accessible directories. Sanitize the `filepath` argument to prevent path traversal. This can be done by resolving the path to an absolute path within a designated safe directory (e.g., a temporary directory or a user-specific output directory) or by validating that the path does not contain `..` segments and is within an allowed base directory. | Static | scripts/gantt_creator.py:350 | |
| MEDIUM | Unpinned Python dependency version Requirement 'matplotlib>=3.7.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | gantt-chart-creator/scripts/requirements.txt:1 | |
| MEDIUM | Unpinned Python dependency version Requirement 'plotly>=5.15.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | gantt-chart-creator/scripts/requirements.txt:2 | |
| MEDIUM | Unpinned Python dependency version Requirement 'pandas>=2.0.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | gantt-chart-creator/scripts/requirements.txt:3 | |
| MEDIUM | Unpinned Python dependency version Requirement 'kaleido>=0.2.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | gantt-chart-creator/scripts/requirements.txt:4 | |
| MEDIUM | Unpinned Python dependency version Requirement 'numpy>=1.24.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | gantt-chart-creator/scripts/requirements.txt:5 |
Scan History
Embed Code
[](https://skillshield.io/report/56a2421ad189a386)
Powered by SkillShield