Trust Assessment
estimate-builder received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via uncontrolled output_path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via uncontrolled output_path The `export_to_excel` method directly uses the `output_path` argument, which can be controlled by untrusted input (e.g., from an LLM user). This allows an attacker to specify an arbitrary file path, potentially leading to overwriting critical system files, writing to sensitive directories, or performing path traversal attacks (e.g., `../../../../tmp/malicious.xlsx`). While the content written is controlled by the skill, overwriting system files can lead to denial of service or other system instability. Implement strict validation and sanitization of the `output_path` argument. Restrict file writes to a specific, sandboxed directory. Prevent path traversal sequences (e.g., `../`). Ensure the path is a valid filename and not an absolute path outside the allowed directory. Consider returning the file content directly or using a temporary file managed by the system rather than allowing user-specified paths. | LLM | SKILL.md:173 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/estimate-builder/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/bdeaf906157a0ab2)
Powered by SkillShield