Trust Assessment
ifc-to-excel received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary executable path in subprocess call.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary executable path in subprocess call The `IFCExporter` class constructor accepts an `exporter_path` argument, which defaults to 'IfcExporter.exe' but can be overridden. This path is then directly used as the executable in a `subprocess.run` call within the `convert` method. If an untrusted user can control the `exporter_path` argument, they can specify an arbitrary executable, leading to arbitrary code execution on the host system. Although `shell=False` is the default for `subprocess.run` with a list of arguments, allowing an arbitrary executable path is a direct command injection vulnerability. Implement strict validation or whitelisting for `exporter_path` to ensure it points only to the intended and trusted `IfcExporter.exe` executable. Alternatively, bundle the `IfcExporter.exe` with the skill and use a fixed, non-configurable path. Ensure the agent calling this skill sanitizes or restricts user-provided values for `exporter_path`. | LLM | SKILL.md:175 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/ifc-to-excel/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/0e6f6a2170802055)
Powered by SkillShield