Trust Assessment
subcontractor-payment-tracker received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via export_report function.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via export_report function The `export_report` method in the `SubcontractorPaymentTracker` class takes `output_path` as an argument and directly uses it to create an Excel file. If an attacker can control this `output_path` (e.g., through a prompt injection or direct user input to the skill), they could write files to arbitrary locations on the file system. This could lead to overwriting critical system files, creating malicious files in web server directories, or exfiltrating data by writing it to a publicly accessible location. Implement strict validation and sanitization for the `output_path` argument. Restrict file writes to a predefined, sandboxed directory. Do not allow arbitrary file paths. Consider returning the report content directly or using a temporary file mechanism rather than writing to a user-specified path. | LLM | SKILL.md:195 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/subcontractor-payment-tracker/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/432b1483a85c3ab9)
Powered by SkillShield