Security Audit
ambient-weather-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
ambient-weather-automation received a trust score of 95/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Broad tool execution capability via RUBE_REMOTE_WORKBENCH.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Broad tool execution capability via RUBE_REMOTE_WORKBENCH The skill's documentation instructs the LLM to use `RUBE_REMOTE_WORKBENCH` for 'Bulk ops', which includes the `run_composio_tool()` function. This function, by its name, suggests the ability to execute any Composio tool, potentially beyond the intended scope of Ambient Weather operations. While the skill's context is Ambient Weather, the `RUBE_REMOTE_WORKBENCH` tool itself offers a generic tool execution capability that could be exploited by a malicious prompt to perform actions outside the skill's stated purpose. 1. If `RUBE_REMOTE_WORKBENCH` is intended only for Ambient Weather tools, ensure `run_composio_tool()` is strictly scoped to `ambient_weather` toolkit operations within the Rube MCP system. 2. Alternatively, provide more specific instructions or a dedicated tool for Ambient Weather bulk operations that does not expose a generic `run_composio_tool()`. 3. If broad access is intended, clearly document the full scope of `RUBE_REMOTE_WORKBENCH` and its implications for security. | LLM | SKILL.md:59 |
Scan History
Embed Code
[](https://skillshield.io/report/25e5b2de868d1aca)
Powered by SkillShield