Trust Assessment
unit-price-database-manager received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary file read via user-controlled path, Arbitrary file write via user-controlled path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary file read via user-controlled path The `import_from_csv` method takes a `file_path` argument directly from user input (via the LLM). An attacker could exploit this to read arbitrary files from the system, potentially including sensitive configuration files, user data, or system files, by supplying a path like `/etc/passwd` or `/app/secrets.txt`. The content of these files would then be processed by pandas, making it accessible to the skill and potentially the LLM. Implement strict validation and sanitization of `file_path` arguments. Restrict file operations to a designated, sandboxed directory. Avoid allowing arbitrary paths. Consider using a file picker or predefined file locations instead of direct path input. | LLM | SKILL.md:244 | |
| HIGH | Arbitrary file write via user-controlled path The `export_to_csv` method takes a `file_path` argument directly from user input (via the LLM). An attacker could exploit this to write data to arbitrary locations on the system. This could lead to overwriting critical system files (e.g., `/etc/hosts`, `/var/www/html/index.html`) or exfiltrating sensitive data by writing it to a publicly accessible directory if the environment allows. Implement strict validation and sanitization of `file_path` arguments. Restrict file operations to a designated, sandboxed directory. Avoid allowing arbitrary paths. Ensure that the skill cannot write outside its intended data storage area. | LLM | SKILL.md:269 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/unit-price-database-manager/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/f3a47ee0b21fccee)
Powered by SkillShield