Trust Assessment
subcontractor-prequalification received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary file write via 'export_register' function.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary file write via 'export_register' function The `export_register` method allows writing sensitive subcontractor application data to an arbitrary `output_path` specified by the caller. An attacker could exploit this to write data to unintended locations, potentially leading to data exfiltration if the path points to an accessible network share or a location that can be read by other processes. This also grants excessive write permissions to the filesystem, as there are no path sanitization or restriction mechanisms in place. Implement strict validation and sanitization of the `output_path` argument. Restrict output to a designated, sandboxed directory. Consider using a UUID for filenames within a secure directory, or only allowing relative paths within a specific output folder. If the skill is intended to be used by an LLM, the LLM should be instructed to only provide safe, pre-approved paths or filenames. | LLM | SKILL.md:136 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/subcontractor-prequalification/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/148a16e1d5a715f7)
Powered by SkillShield