Trust Assessment
cwicr-waste-calculator received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via User-Controlled Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via User-Controlled Path The `export_waste_report` function directly uses the `output_path` parameter, which is user-controlled, to write an Excel file. This allows a malicious actor to specify an arbitrary file path on the filesystem. This could lead to overwriting critical system files, writing to sensitive directories, or creating executable files in locations that could be triggered by other processes, potentially resulting in denial of service, data corruption, or even remote code execution if the agent runs with elevated permissions. Implement strict validation and sanitization of the `output_path` parameter. Restrict file writes to a designated, sandboxed directory. Prevent directory traversal (e.g., `../`). Consider returning the report content as a byte stream or base64 encoded string instead of writing to the filesystem, or use a temporary file mechanism if local storage is strictly necessary. | LLM | SKILL.md:248 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/cwicr-waste-calculator/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/ef90858ff8bc3589)
Powered by SkillShield