Trust Assessment
bid-analysis-comparator received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Unsafe File Write via User-Controlled Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/bid-analysis-comparator/SKILL.md:1 | |
| MEDIUM | Unsafe File Write via User-Controlled Path The `export_analysis` method writes an Excel file to a path (`output_path`) provided as an argument without any path sanitization or validation. This could allow an attacker to write files to arbitrary locations on the file system if the skill is executed with sufficient write permissions (e.g., path traversal attacks like `../../../../tmp/malicious.xlsx`). This represents an excessive permission risk if the skill's execution environment is not properly sandboxed. Implement robust path sanitization for `output_path` to ensure files are written only within an allowed, sandboxed directory. Alternatively, ensure the execution environment for the skill strictly limits file system write access to designated safe directories, preventing writes to sensitive system locations. | LLM | SKILL.md:107 |
Scan History
Embed Code
[](https://skillshield.io/report/0cd31e8e5da487c2)
Powered by SkillShield