Trust Assessment
decision-support received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via `export_to_excel`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via `export_to_excel` The `export_to_excel` method in the `DecisionSupportSystem` class allows writing an Excel file to an arbitrary `output_path` specified by the user. This lack of path validation and sanitization can be exploited to overwrite or create files in sensitive system locations, leading to data corruption, denial of service, or potentially other system compromises if the skill runs with elevated privileges. An attacker could provide a path like `/etc/passwd` or `/var/log/auth.log` to attempt to overwrite critical system files. Implement strict path validation and sanitization for the `output_path` argument. Restrict file writes to a designated, secure directory (e.g., a temporary directory or a user-specific output folder). Prevent directory traversal characters (e.g., `..`, `/`) and absolute paths from being used. Consider using a library function like `os.path.basename` to only allow writing to the current working directory or a predefined safe directory. | LLM | SKILL.md:299 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/decision-support/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/56ae00219340eef0)
Powered by SkillShield