Trust Assessment
labor-productivity-analyzer received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via `export_report`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via `export_report` The `export_report` method in `LaborProductivityAnalyzer` allows writing an Excel file to an arbitrary `output_path` provided as an argument. If this parameter is controlled by untrusted input (e.g., from an LLM user), an attacker could specify paths to sensitive filesystem locations, potentially overwriting critical system files, or writing malicious content to directories that are later executed or served. This could lead to data exfiltration, denial of service, or remote code execution. Implement strict path validation and sanitization for `output_path`. Ensure that files can only be written to a designated, secure output directory, and prevent directory traversal (e.g., by resolving the path and checking if it's within an allowed base directory). Consider returning the data directly or using a temporary file mechanism if persistent storage to an arbitrary path is not strictly required. | LLM | SKILL.md:143 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/labor-productivity-analyzer/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/3c3cb1c30aefd222)
Powered by SkillShield