Trust Assessment
interoperability-analyzer received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Unvalidated file path in export_analysis function.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unvalidated file path in export_analysis function The `export_analysis` function accepts an `output_path` string parameter and uses it directly to create an Excel file without any path validation or sanitization. If this function were exposed as a tool to an AI agent, a malicious user could craft an `output_path` (e.g., using path traversal sequences like `../`) to write files to arbitrary locations on the filesystem. This could lead to overwriting critical system files, data corruption, denial of service, or potentially privilege escalation. Implement robust path validation and sanitization for the `output_path` parameter. Restrict file writes to a designated, sandboxed directory. Consider using a library like `pathlib` for safer path manipulation and `os.path.abspath` combined with checks to ensure the path is within an allowed directory. Alternatively, only allow the skill to return the data, and let the calling environment handle file writing. | LLM | SKILL.md:207 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/interoperability-analyzer/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/13ff82cdc75fdfbf)
Powered by SkillShield