Trust Assessment
rvt-to-excel received a trust score of 58/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 1 critical, 1 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via External Executable Arguments, Supply Chain Risk - Unverified External Executable (RvtExporter.exe).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 48/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Supply Chain Risk - Unverified External Executable (RvtExporter.exe) The skill relies on a custom external executable, `RvtExporter.exe`, which is to be downloaded from 'repository releases'. There is no information provided regarding its source code, build process, cryptographic signatures, or vulnerability scanning. This poses a significant supply chain risk, as a compromised binary could lead to arbitrary code execution, data exfiltration, or other malicious activities when executed by the agent. Provide the source code for `RvtExporter.exe` for review and compilation, or ensure the binary is cryptographically signed and its integrity can be verified against a trusted source. Implement a secure distribution mechanism for the executable. | LLM | SKILL.md:33 | |
| HIGH | Potential Command Injection via External Executable Arguments The skill uses `subprocess.run` to execute an external binary (`RvtExporter.exe`) with arguments derived from user-controlled input (`rvt_file`, `mode`, `options`). While `subprocess.run` with a list of arguments prevents shell injection, a vulnerable `RvtExporter.exe` could still be susceptible to argument injection, allowing an attacker to execute arbitrary commands by crafting malicious input values. The skill facilitates passing these potentially untrusted inputs to the external executable. Implement strict input validation and sanitization for all arguments passed to `RvtExporter.exe`. Ensure `RvtExporter.exe` itself is robust against argument injection and only interprets arguments as data, not commands. Consider sandboxing the execution of `RvtExporter.exe`. | LLM | SKILL.md:39 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/rvt-to-excel/SKILL.md:1 | |
| MEDIUM | Supply Chain Risk - Opaque Python Dependency (semantic_search) The skill imports `CWICRSemanticSearch` from the `semantic_search` module. The implementation of this module is not provided within the skill context, making it an opaque dependency. Without visibility into its code, potential vulnerabilities, malicious functionality, or excessive permissions cannot be assessed, posing a supply chain risk. Provide the source code for the `semantic_search` module or specify its trusted source, version, and any relevant security audits. Ensure all third-party dependencies are vetted and their security implications understood. | LLM | SKILL.md:118 |
Scan History
Embed Code
[](https://skillshield.io/report/c9eef61f176b5579)
Powered by SkillShield