Trust Assessment
cwicr-takeoff-helper received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via Unsanitized Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via Unsanitized Path The `export_takeoff` method directly uses an `output_path` argument, which is likely to be derived from user input, to write an Excel file. This allows an attacker to specify an arbitrary file path, potentially leading to overwriting critical system files, writing to unauthorized locations, or exhausting disk space if the skill runs with sufficient file system permissions. This is a common vulnerability when user-controlled paths are not properly sanitized or restricted. Implement strict path validation and sanitization for `output_path`. Ensure the path is confined to a designated, secure output directory (e.g., a temporary directory or a user-specific sandbox). Prevent directory traversal characters (e.g., `../`) and enforce allowed file extensions (e.g., `.xlsx`). The execution environment should also enforce least privilege for file system access. | LLM | SKILL.md:319 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/cwicr-takeoff-helper/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/c153b52365fc868c)
Powered by SkillShield