Trust Assessment
warranty-tracker received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Arbitrary File Write via export_to_excel.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via export_to_excel The `export_to_excel` method allows writing an Excel file to an arbitrary `output_path` provided as an argument. If this `output_path` is derived from untrusted user input without proper validation, an attacker could specify a malicious path (e.g., an absolute path outside the intended directory, or a path traversal sequence like `../../`) to overwrite sensitive system files, exfiltrate data to an accessible location, or cause a denial of service by filling up disk space or corrupting critical files. Implement strict validation and sanitization of the `output_path` argument. Restrict file writes to a designated, sandboxed directory. Prevent path traversal (`../`) and absolute paths. Consider returning the file content as a byte stream rather than writing to a local file if possible, or ensure the filename is generated internally and securely. | LLM | SKILL.md:338 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/warranty-tracker/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/fddbf8737df8dff6)
Powered by SkillShield