Trust Assessment
retail-trade-report-generator received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Unrestricted File Path Access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unrestricted File Path Access The skill directly uses user-provided `input_dir` and `mapping_csv_path` parameters in file system operations (`os.listdir`, `pandas.read_csv`, `pandas.read_excel`) without validation or sanitization. If the hosting environment does not strictly sandbox these paths, a malicious user could provide paths to sensitive system directories (e.g., `/etc`, `/root`) or files (e.g., `/etc/passwd`), leading to information disclosure (listing arbitrary directories) or data exfiltration (attempting to read arbitrary files). Implement robust path validation and sanitization to ensure that all file paths provided by the user are strictly confined to an allowed, sandboxed directory (e.g., `/mnt/user-data/uploads/`). This could involve checking for path traversal sequences (e.g., '..') and ensuring paths are absolute and within the designated user data directory. Alternatively, rely on the platform's guaranteed sandboxing for these inputs. | LLM | scripts/retail_trade_report_generator.py:23 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/wuminmin/retail-trade-report-generator/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/b553fca758b86b12)
Powered by SkillShield