Security Audit
chmeetings-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
chmeetings-automation received a trust score of 93/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unpinned Rube MCP dependency, Skill enables broad access to Chmeetings via Rube MCP.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Rube MCP dependency The skill declares a dependency on the 'rube' MCP without specifying a version. This means the skill will always use the latest version of the Rube MCP. While common for external services, this lack of version pinning can introduce supply chain risks, as updates to the MCP could potentially introduce breaking changes, unexpected behavior, or, in a worst-case scenario, malicious functionality without explicit review or control by the skill developer or user. If the MCP system supports it, specify a version or a version range for the 'rube' MCP dependency in the manifest to ensure stability and allow for controlled updates. If direct version pinning is not feasible for external MCPs, users should be aware of the implicit reliance on the latest version and monitor the MCP provider for security advisories. | Static | SKILL.md | |
| INFO | Skill enables broad access to Chmeetings via Rube MCP The skill's primary function is to automate Chmeetings tasks by leveraging Rube MCP tools such as `RUBE_MULTI_EXECUTE_TOOL` and `RUBE_REMOTE_WORKBENCH`. These tools, by design, provide extensive capabilities to interact with the connected Chmeetings account, potentially including creating, reading, updating, and deleting various types of data. While this broad access is inherent to the skill's stated purpose of 'automating Chmeetings tasks', users should be aware that the AI agent, when using this skill, will have significant control over their Chmeetings data. This is a functional characteristic rather than a vulnerability, but it highlights the importance of careful deployment and monitoring. Users should ensure that the AI agent is only granted access to Chmeetings accounts with the minimum necessary privileges required for its intended operations. Implement robust monitoring and auditing of the AI agent's actions within Chmeetings to detect any unauthorized or anomalous behavior. Regularly review the scope of access granted to the Rube MCP connection for Chmeetings. | Static | SKILL.md:50 |
Scan History
Embed Code
[](https://skillshield.io/report/d16525d389045f28)
Powered by SkillShield