Trust Assessment
cwicr-overhead-markup received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Unrestricted file write via output_path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unrestricted file write via output_path The `export_pricing` method allows writing an Excel file to an arbitrary `output_path` provided by the user. If the AI agent skill is executed with sufficient filesystem permissions, an attacker could exploit this to overwrite critical system files, write malicious content to sensitive directories (e.g., web server roots), or fill up disk space, leading to data corruption, denial of service, or further compromise. This constitutes an excessive permission vulnerability. Implement strict validation and sanitization for `output_path`. Restrict file writes to a predefined, secure directory (e.g., a temporary directory or a user-specific sandbox). Do not allow arbitrary paths. Consider returning the file content directly or using a secure file storage service instead of writing to the local filesystem. | LLM | SKILL.md:249 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/cwicr-overhead-markup/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/b65803a5fd50cf1a)
Powered by SkillShield