Trust Assessment
cwicr-assembly-builder received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Unrestricted file write via `export_assemblies`, Unrestricted file write via `save_library`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unrestricted file write via `export_assemblies` The `export_assemblies` method allows writing an Excel file to an arbitrary `output_path` provided as an argument. If this argument is derived from untrusted user input, it could lead to arbitrary file write vulnerabilities. An attacker could potentially overwrite critical system files, exfiltrate data by writing to publicly accessible directories, or enable further attacks by placing malicious files. Implement strict validation and sanitization of `output_path` to ensure it points to an allowed, sandboxed directory. Prevent directory traversal (`../`) and restrict writes to only designated, secure output locations. Consider using a temporary file or a pre-defined, secure output directory. | LLM | SKILL.md:242 | |
| HIGH | Unrestricted file write via `save_library` The `save_library` method allows writing a JSON file to an arbitrary `filepath` provided as an argument. If this argument is derived from untrusted user input, it could lead to arbitrary file write vulnerabilities. An attacker could potentially overwrite critical system files, exfiltrate data by writing to publicly accessible directories, or enable further attacks by placing malicious files. Implement strict validation and sanitization of `filepath` to ensure it points to an allowed, sandboxed directory. Prevent directory traversal (`../`) and restrict writes to only designated, secure output locations. Consider using a temporary file or a pre-defined, secure output directory. | LLM | SKILL.md:298 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/cwicr-assembly-builder/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/a7be02462a06e98f)
Powered by SkillShield