Trust Assessment
as-built-documentation received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Unrestricted File Write via 'export_register'.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unrestricted File Write via 'export_register' The `export_register` method allows writing an Excel file containing project documentation and markup data to an arbitrary `output_path` provided by the user. This grants the skill unrestricted write access to the filesystem, enabling potential data exfiltration by writing sensitive information to an attacker-controlled or publicly accessible location, or denial-of-service by overwriting critical system files. The skill should restrict file operations to a secure, isolated directory or use platform-provided secure storage mechanisms. Restrict the `output_path` to a predefined, secure, and isolated directory (e.g., a temporary directory or a specific output folder managed by the agent runtime). Implement strict validation and sanitization of the `output_path` to prevent directory traversal attacks. Consider if direct file system access is truly necessary; if the output is meant for the user, it might be safer to return the data directly or use a secure file upload mechanism provided by the agent platform. | LLM | SKILL.md:170 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/as-built-documentation/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/24989b8024202a74)
Powered by SkillShield