Trust Assessment
daily-report-generator received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary file read vulnerability, Arbitrary file write vulnerability.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary file read vulnerability The skill's `generate_daily_report` and `import_timesheet` functions use `pandas.read_excel` and `pandas.read_csv` with file paths (`timesheet_path`, `tasks_path`, `source`) that are passed as arguments. If these arguments are controlled by an untrusted input (e.g., an LLM prompt or user input), an attacker could specify paths to arbitrary files on the system, potentially leading to data exfiltration. Validate and sanitize all file paths provided as input to ensure they are within an allowed directory or conform to expected patterns. Consider using a whitelist of allowed directories or a sandbox environment. | LLM | SKILL.md:200 | |
| HIGH | Arbitrary file write vulnerability The `generate_daily_report` function constructs an `output_path` using `os.path.join(output_dir, ...)`, where `output_dir` is an argument. This `output_path` is then used by `reportlab.platypus.SimpleDocTemplate` to create a PDF file. If `output_dir` is controlled by an untrusted input, an attacker could specify an arbitrary directory, potentially overwriting critical system files or writing to sensitive locations, leading to denial of service or further compromise. Validate and sanitize the `output_dir` argument to ensure it points to a safe, designated output directory. Prevent directory traversal (`../`) and ensure the path is absolute and within an allowed sandbox. | LLM | SKILL.md:216 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/daily-report-generator/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/96e6b9cba34ab1aa)
Powered by SkillShield