Security Audit
calendarhero-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
calendarhero-automation received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Potential Excessive Tool Permissions via RUBE_REMOTE_WORKBENCH, Unpinned MCP dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Excessive Tool Permissions via RUBE_REMOTE_WORKBENCH The skill's documentation describes the use of `RUBE_REMOTE_WORKBENCH` with `run_composio_tool()` for 'Bulk ops'. While the skill's stated purpose is 'Calendarhero Automation', `RUBE_REMOTE_WORKBENCH` and `run_composio_tool()` are generic Composio mechanisms. If `run_composio_tool()` can invoke any tool available through the Composio platform (and not just Calendarhero-specific tools), this skill would possess permissions far exceeding its declared scope. This broad access could potentially allow an LLM, if maliciously prompted, to interact with other integrated services (e.g., Slack, GitHub, etc.) that the Rube MCP might provide access to, even if those services are unrelated to Calendarhero. To mitigate this, the Rube MCP should enforce tool access based on the skill's declared purpose (e.g., only allow Calendarhero tools for this skill). If such enforcement is not possible at the MCP level, the skill's documentation should explicitly state that `RUBE_REMOTE_WORKBENCH` is strictly limited to Calendarhero operations, and the LLM should be rigorously instructed to adhere to this limitation. | Static | SKILL.md:67 | |
| LOW | Unpinned MCP dependency The skill's manifest declares a dependency on the 'rube' MCP without specifying a version or a specific immutable identifier. This means the skill implicitly trusts the current version of the 'rube' MCP service provided by `https://rube.app/mcp`. If the 'rube' MCP were to change its behavior in an undesirable way or be compromised, the skill could be affected without explicit user or developer intervention to update or verify the dependency, leading to potential instability or security vulnerabilities. If possible within the `claude_code` ecosystem, specify a version, hash, or a more specific immutable identifier for the 'rube' MCP dependency in the `requires` field. This practice helps ensure stability and prevents unexpected behavior from upstream changes or compromises to the MCP service. | Static | SKILL.md:5 |
Scan History
Embed Code
[](https://skillshield.io/report/6b9ca55f548602f3)
Powered by SkillShield