Security audit
Security checks for vulnerabilities and agentic risk
This skill is a construction cost-estimation helper with disclosed local file and network use, but users should handle exported estimates and pricing database edits carefully.
Install only if you are comfortable letting the skill read pricing data, access pricing-related network endpoints, and write estimate reports or pricing CSVs. Treat exported Excel files and modified pricing databases as potentially sensitive business records, and choose output paths and data sources deliberately.
The manifest and overview describe a skill for accessing public pricing databases, matching BIM elements, and calculating costs. However, the OpenDatabaseManager section adds item creation, price updates, inflation adjustment, subset export, and full database save operations, which go beyond simple access and utilization into database maintenance and modification.
The description frames the skill around open construction pricing databases and public unit price data. Listing RSMeans Online (subscription) introduces a non-open proprietary data source that does not align with the stated open/public focus.
The file contains a quoted passage in Russian while the rest of the skill documentation is in English, with no indication that multilingual content is optional or region-specific. This can conflict with language/locale policy expectations when a skill presents a specific language without user opt-in or justification.
The export function writes project-derived estimate details to an arbitrary output path without any warning or guidance about handling potentially sensitive project data. In a real deployment, this can lead to unintended persistence of cost, scope, and building-component information on disk, especially if users assume the skill is read-only or ephemeral.
No suspicious patterns detected.
