Security Audit
acculynx-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
acculynx-automation received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned External MCP Dependency, Broad Tool Execution Permissions via Rube MCP.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned External MCP Dependency The skill relies on an external Managed Control Plane (MCP) 'rube' without specifying a version. This means the skill will always use the latest version provided by 'https://rube.app/mcp'. If the 'rube' MCP introduces breaking changes, vulnerabilities, or malicious functionality, the skill would automatically inherit these without explicit review, posing a significant supply chain risk. This is analogous to an unpinned software dependency. If possible, specify a version or a hash for the 'rube' MCP dependency in the manifest to ensure deterministic behavior and prevent unexpected changes or malicious updates from the external service. Implement a mechanism to validate the integrity and behavior of the MCP before use. | LLM | SKILL.md:1 | |
| MEDIUM | Broad Tool Execution Permissions via Rube MCP The skill's manifest declares a dependency on the 'rube' MCP, which provides powerful tools like `RUBE_MULTI_EXECUTE_TOOL` and `RUBE_REMOTE_WORKBENCH`. These tools, as described in the skill, allow for the execution of arbitrary Composio tools discovered via `RUBE_SEARCH_TOOLS`. While these broad capabilities are necessary for the skill's intended automation, they also mean that if the LLM's instructions are compromised (e.g., via prompt injection), these extensive permissions could be leveraged to perform unintended or malicious actions through the Rube MCP, potentially interacting with external systems in an unauthorized manner. Ensure robust input validation and sanitization for any arguments passed to `RUBE_MULTI_EXECUTE_TOOL` and `RUBE_REMOTE_WORKBENCH`. Implement strict access controls and monitoring on the Rube MCP side to limit the scope of actions an agent can perform, even if its instructions are compromised. Consider fine-grained permissions if the MCP supports it to restrict the agent's capabilities to only what is strictly necessary for the skill. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/b61bdab4e29ac3ce)
Powered by SkillShield