Trust Assessment
equipment-fleet-manager received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via `export_fleet` method.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary File Write via `export_fleet` method The `export_fleet` method allows writing an Excel file to an arbitrary `output_path` provided as an argument. If this argument is controlled by untrusted input (e.g., from an LLM prompt or user input), an attacker could specify sensitive file paths (e.g., `/etc/passwd`, `/var/www/html/shell.php`) to overwrite existing files or create new ones. This can lead to data loss, denial of service, or potentially remote code execution if an executable file is overwritten or created in a sensitive location. This represents an excessive permission granted to the skill, allowing it to write to any location on the filesystem. Restrict the `output_path` to a safe, sandboxed directory (e.g., a temporary directory or a user-specific output folder). Implement strict validation to ensure the path does not contain directory traversal sequences (e.g., `../`) and is within the allowed scope. Consider using a dedicated file storage service or a more controlled file export mechanism that does not expose arbitrary filesystem write capabilities. | LLM | SKILL.md:140 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/equipment-fleet-manager/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/80d2cebbf484166f)
Powered by SkillShield