Trust Assessment
cwicr-work-breakdown received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via User-Controlled Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via User-Controlled Path The `export_breakdown` and `export_bill_of_resources` methods allow writing Excel files to an `output_path` provided as an argument. If an attacker or a malicious LLM prompt can control this path, it could lead to arbitrary file writes. This could be exploited for data exfiltration (by writing skill-generated data to an accessible location), overwriting critical system files (if permissions allow), or denial of service by filling up disk space or overwriting important files. Implement strict path validation to ensure `output_path` is restricted to a safe, sandboxed directory (e.g., a temporary directory or a user-specific output directory). Do not allow writing to arbitrary paths provided by untrusted input. Consider using a file system abstraction layer that enforces these restrictions. | LLM | SKILL.md:238 | |
| HIGH | Arbitrary File Write via User-Controlled Path The `export_breakdown` and `export_bill_of_resources` methods allow writing Excel files to an `output_path` provided as an argument. If an attacker or a malicious LLM prompt can control this path, it could lead to arbitrary file writes. This could be exploited for data exfiltration (by writing skill-generated data to an accessible location), overwriting critical system files (if permissions allow), or denial of service by filling up disk space or overwriting important files. Implement strict path validation to ensure `output_path` is restricted to a safe, sandboxed directory (e.g., a temporary directory or a user-specific output directory). Do not allow writing to arbitrary paths provided by untrusted input. Consider using a file system abstraction layer that enforces these restrictions. | LLM | SKILL.md:252 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/cwicr-work-breakdown/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/0dd04383e99c7473)
Powered by SkillShield