Trust Assessment
carbon-calculator received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, User-controlled arbitrary file write via export_to_excel.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/carbon-calculator/SKILL.md:1 | |
| MEDIUM | User-controlled arbitrary file write via export_to_excel The `export_to_excel` method allows writing an Excel file to an arbitrary `output_path` provided as an argument. If the skill's execution environment has broad filesystem write permissions, an attacker could specify a malicious path to overwrite critical system files, cause a denial of service, or write to sensitive locations. While the content written is the carbon calculation report and not arbitrary, the ability to control the destination path is a significant security risk. Restrict the `output_path` to a safe, sandboxed directory (e.g., a temporary directory or a user-specific output directory). Implement strict validation and sanitization of the `output_path` to prevent directory traversal attacks (e.g., `../`). Consider only allowing the user to specify a filename, with the base path managed internally by the skill. | LLM | SKILL.md:248 |
Scan History
Embed Code
[](https://skillshield.io/report/6a10ffd12203d5bd)
Powered by SkillShield