Trust Assessment
cwicr-subcontractor received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via Unsanitized Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via Unsanitized Path The `export_bid_comparison` method allows writing an Excel file to an arbitrary `output_path` provided as a string parameter. If this parameter is derived from untrusted user input without proper sanitization, it could lead to path traversal vulnerabilities, allowing an attacker to write files to unintended locations on the filesystem. This could result in data exfiltration (e.g., writing sensitive bid comparison data to a publicly accessible directory), overwriting critical system files, or denial of service. Implement strict path validation and sanitization for the `output_path` parameter. Restrict file writes to a designated, sandboxed directory to prevent writing to arbitrary locations. If the skill is exposed via an LLM, ensure the LLM layer sanitizes or restricts the `output_path` parameter before passing it to the skill. | LLM | SKILL.md:208 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/cwicr-subcontractor/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/7ee3b14bdff524f7)
Powered by SkillShield