Trust Assessment
cad-to-data received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary file write via export_to_json method.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary file write via export_to_json method The `export_to_json` method in the `CADDataConverter` class takes a user-controlled `output_path` argument. It directly uses this path to open and write a JSON file (`with open(output_path, 'w') as f: json.dump(output, f, indent=2)`). This allows an attacker to write arbitrary data (the extraction result) to any location on the filesystem accessible to the agent, potentially overwriting critical system files, creating new files in sensitive directories, or facilitating data exfiltration by writing to publicly accessible locations. Implement strict path validation and sanitization for `output_path`. Restrict write operations to a designated, sandboxed output directory. Consider using a file picker or a secure file storage service instead of direct path input to prevent arbitrary file system access. | LLM | SKILL.md:377 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/cad-to-data/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/e58db5010c81a4c4)
Powered by SkillShield