Trust Assessment
batch-cad-converter received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary Code Execution via User-Controlled Converter Paths.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary Code Execution via User-Controlled Converter Paths The `BatchCADConverter` skill allows users to specify arbitrary paths for external converter executables through the `converter_dir` parameter and the `converters` dictionary in its constructor. The `_get_converter` method resolves these paths, and the `convert_file` method then executes the resolved path using `subprocess.run`. A malicious actor can configure these parameters to point to any executable on the system, including system utilities or malicious scripts. For example, by setting a converter to `/bin/sh` and providing a crafted `input_file` or `options`, arbitrary shell commands can be executed. This constitutes an arbitrary code execution vulnerability, granting an attacker full control over the system where the skill is run. Additionally, the skill has broad filesystem access (reading from `input_folder`, writing to `output_folder` and `output_path`), which further amplifies the impact of this vulnerability. 1. **Restrict Converter Paths**: Limit `converter_dir` and `converters` to a predefined, allow-listed set of trusted directories and executables. Do not allow arbitrary paths. 2. **Input Validation**: Strictly validate `input_file` and `options` to ensure they do not contain malicious commands or paths. 3. **Sandboxing/Isolation**: Run the `subprocess.run` calls within a sandboxed environment (e.g., Docker container, chroot jail) with minimal necessary permissions to prevent system-wide compromise. 4. **Principle of Least Privilege**: Ensure the process running the skill has only the absolute minimum permissions required. | LLM | SKILL.md:100 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/batch-cad-converter/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/69e7e39aba4e7c0c)
Powered by SkillShield