Trust Assessment
project-closeout-checklist received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via Unsanitized Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via Unsanitized Path The `export_checklist` method allows writing project data to an arbitrary file path specified by the `output_path` argument. If this argument can be controlled by untrusted input (e.g., via a prompt to the LLM), an attacker could specify a path to a sensitive system file or a publicly accessible directory. This could lead to overwriting critical system files (denial of service), or exfiltrating project data by writing it to a web-accessible location. Implement strict validation and sanitization of the `output_path` argument. Restrict file writes to a designated, sandboxed directory. Prevent directory traversal attacks (e.g., by using `os.path.basename` or `pathlib.Path.resolve()` with a base directory check). The calling environment (LLM) should enforce strict sandboxing for file system operations. | LLM | SKILL.md:150 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/project-closeout-checklist/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/3697725054ab8eab)
Powered by SkillShield