Security Audit
abuselpdb-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
abuselpdb-automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Excessive Dynamic Tool Execution Permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Excessive Dynamic Tool Execution Permissions The skill instructs the LLM to dynamically discover tools using `RUBE_SEARCH_TOOLS` based on a natural language `use_case` query, and then execute any returned tool via `RUBE_MULTI_EXECUTE_TOOL` or `RUBE_REMOTE_WORKBENCH`. This pattern grants the LLM overly broad and dynamic execution permissions. If the `RUBE_SEARCH_TOOLS` system can be manipulated (e.g., by a malicious user prompt or a compromised Rube MCP) to return tools with capabilities beyond the intended 'Abuselpdb operations' (e.g., filesystem access, network requests, or other sensitive operations), the LLM is instructed to execute them. This creates a significant risk of privilege escalation or unintended actions, as the LLM's execution capabilities are not fixed but depend on the dynamic and potentially ambiguous output of `RUBE_SEARCH_TOOLS`. Implement strict whitelisting of allowed `tool_slug` values that the LLM can execute, rather than relying solely on dynamic discovery. If dynamic discovery is necessary, ensure the `RUBE_SEARCH_TOOLS` query is highly constrained and that the LLM is explicitly instructed to validate discovered tools against a predefined list of safe operations or capabilities. Consider a human-in-the-loop approval process for executing dynamically discovered tools with sensitive capabilities. | Static | SKILL.md:30 |
Scan History
Embed Code
[](https://skillshield.io/report/c18463ab12b255f6)
Powered by SkillShield