Trust Assessment
progress-monitoring-cv received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Read via User-Controlled Paths, Arbitrary File Write via Report Output Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Read via User-Controlled Paths The skill uses `Image.open()` and `cv2.imread()` with user-controlled `image_path` and `bim_render_path` arguments in methods like `analyze_image`, `compare_to_bim`, and `add_image`. An attacker could provide paths to arbitrary files on the filesystem. If these files are valid image formats or can be parsed, their content will be loaded and processed by the skill. This could lead to the exposure of sensitive information (e.g., metadata from a screenshot of a private document) within the `ProgressReport` or other outputs, constituting data exfiltration. Implement strict input validation for all file paths (`image_path`, `bim_render_path`) to ensure they point only to allowed, non-sensitive directories. Sanitize paths to prevent directory traversal (e.g., `../`). Consider sandboxing the skill's file system access to restrict it to a dedicated, isolated directory. | LLM | SKILL.md:70 | |
| HIGH | Arbitrary File Write via Report Output Path The `generate_report` method in `TimeLapseAnalyzer` writes an Excel file to a user-controlled `output_path`. An attacker could specify an arbitrary path on the filesystem, potentially overwriting critical system files, writing malicious scripts (e.g., cron jobs, web shells), or filling up disk space, leading to denial of service or remote code execution. This also poses a data exfiltration risk if an attacker can write to a publicly accessible location or overwrite logs. Implement strict input validation for `output_path` to ensure it points only to allowed, non-sensitive directories. Sanitize paths to prevent directory traversal. The skill should ideally write to a temporary or designated output directory, and the agent should handle moving the file to its final destination. Consider sandboxing the skill's file system write access. | LLM | SKILL.md:260 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/progress-monitoring-cv/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/34c5562bf5798e1f)
Powered by SkillShield