Security Audit
borneo-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
borneo-automation received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Vague and Potentially Overly Permissive `RUBE_REMOTE_WORKBENCH` Tool.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Vague and Potentially Overly Permissive `RUBE_REMOTE_WORKBENCH` Tool The skill documentation mentions `RUBE_REMOTE_WORKBENCH` for 'Bulk ops' with `run_composio_tool()`. The term 'workbench' often implies an environment capable of executing arbitrary code or complex, potentially privileged, operations. Without detailed schema or usage guidelines provided in the skill, this tool could grant excessive permissions to the LLM, potentially allowing for command injection, arbitrary code execution, or unintended data manipulation on the remote Borneo system if user input is passed to it. The lack of transparency regarding its exact capabilities and security implications makes it a high-risk component. Provide a detailed schema and clear security guidelines for `RUBE_REMOTE_WORKBENCH`. Explicitly state its exact capabilities, input validation mechanisms, and any sandboxing or privilege separation in place. If it allows arbitrary code execution, this should be clearly documented with strong warnings about its use and the necessity of strict input sanitization. | LLM | SKILL.md:80 |
Scan History
Embed Code
[](https://skillshield.io/report/dc7ac3e16b56e606)
Powered by SkillShield