Trust Assessment
change-order-processor received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Unvalidated file path in export function.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unvalidated file path in export function The `export_log` method takes an `output_path` argument directly from input and uses it to write an Excel file. This allows an attacker to specify an arbitrary file path, potentially leading to data exfiltration (writing sensitive project data to an attacker-controlled or publicly accessible location) or denial of service (overwriting critical system files, filling up disk space). There is no validation or sanitization of the provided path, making the skill vulnerable to directory traversal attacks. Implement strict path validation for `output_path`. Restrict file writes to a designated, secure directory (e.g., a temporary directory or a user-specific output folder). Sanitize the filename to prevent directory traversal attacks (e.g., `../`). Ensure the skill's execution environment has minimal necessary write permissions. | LLM | SKILL.md:331 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/change-order-processor/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/21a99b0f0cfac6d2)
Powered by SkillShield