Trust Assessment
pdf-construction received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File System Access via User-Controlled Paths, Unpinned Dependencies in `pip install`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File System Access via User-Controlled Paths The skill's functions (`extract_rfi_data`, `create_submittal_package`, `extract_spec_sections`, `split_drawing_package`) accept arbitrary file paths as arguments for reading and writing PDF and Excel files, and for creating directories. This allows a malicious actor to potentially read sensitive files from the system (e.g., `/etc/passwd`, `~/.ssh/id_rsa`), overwrite critical system files, or create directories in arbitrary locations if the underlying execution environment does not properly sandbox file system access. This constitutes both excessive permissions and a data exfiltration risk. Implement strict input validation for all file paths to ensure they are within an allowed, sandboxed directory. Avoid allowing arbitrary paths. If the skill must operate on user-provided files, ensure the execution environment enforces a strict sandbox (e.g., containerization with limited volume mounts) and that file operations are restricted to a designated temporary or user-specific directory. | LLM | SKILL.md:13 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/pdf-construction/SKILL.md:1 | |
| MEDIUM | Unpinned Dependencies in `pip install` The `pip install` command lists dependencies (`pypdf`, `pdfplumber`, `reportlab`) without specifying exact versions. This can lead to non-deterministic builds, where different versions of libraries might be installed over time. This introduces a supply chain risk, as a future update to any of these libraries could introduce breaking changes, new vulnerabilities, or even malicious code without explicit review. Pin all dependencies to specific versions (e.g., `pypdf==3.17.1`). Regularly review and update these pinned versions to incorporate security patches and new features in a controlled manner. Consider using a `requirements.txt` file with exact versions. | LLM | SKILL.md:127 |
Scan History
Embed Code
[](https://skillshield.io/report/c97106f253d357ee)
Powered by SkillShield