Trust Assessment
cwicr-labor-scheduler received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary file write via unvalidated output_path in export_to_excel.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary file write via unvalidated output_path in export_to_excel The `export_to_excel` method in `WeeklyScheduleGenerator` takes an `output_path` argument directly from user input and uses it to create an Excel file using `pd.ExcelWriter`. Without proper sanitization or validation of this path, an attacker could provide a path traversal sequence (e.g., `../../../../etc/passwd` or `C:\Windows\System32\config.xlsx`) to write to arbitrary locations on the filesystem. This could lead to overwriting critical system files, exfiltrating data by writing to a web-accessible directory, or achieving remote code execution if a malicious file is placed in a sensitive location. Implement robust path validation and sanitization for the `output_path` argument. This should include normalizing the path, checking for directory traversal sequences (e.g., `..`), and restricting the output directory to a specific, sandboxed location. Ensure the final path is within an allowed base directory using functions like `os.path.abspath` and `os.path.commonprefix`. | LLM | SKILL.md:295 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/cwicr-labor-scheduler/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/533d74bc88f5a4f6)
Powered by SkillShield