Security Audit
dialpad-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
dialpad-automation received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Excessive Permissions via Rube MCP Tools, Potential Credential Mismanagement via Connection Tool.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Excessive Permissions via Rube MCP Tools The skill instructs the host LLM to use powerful Rube MCP tools such as `RUBE_MANAGE_CONNECTIONS`, `RUBE_MULTI_EXECUTE_TOOL`, and `RUBE_REMOTE_WORKBENCH`. These tools grant broad control over the connected Dialpad account, allowing the LLM to manage connections (including authentication details) and execute arbitrary Dialpad operations. A malicious prompt could exploit this broad access to perform unauthorized actions on the Dialpad account, such as accessing sensitive data, making calls, or altering settings. Implement fine-grained access control for the Rube MCP tools, limiting the specific Dialpad operations an LLM can perform. Ensure that the LLM's access to `RUBE_MANAGE_CONNECTIONS` is restricted to only necessary actions, and consider human approval for sensitive operations. The skill description should clearly state the scope of operations and any limitations. | LLM | SKILL.md:39 | |
| MEDIUM | Potential Credential Mismanagement via Connection Tool The skill guides the LLM to use `RUBE_MANAGE_CONNECTIONS` for setting up and verifying Dialpad connections, which involves interacting with authentication flows and potentially handling sensitive credentials (e.g., OAuth tokens). While the skill itself does not harvest credentials, it places the LLM in a position to manage them. A malicious prompt could instruct the LLM to misuse this capability to expose connection details, alter authentication settings, or create unauthorized connections. Ensure that the `RUBE_MANAGE_CONNECTIONS` tool has robust security measures, such as requiring explicit user confirmation for sensitive actions (e.g., revoking tokens, changing connection details) or restricting the LLM's ability to view raw credential data. Implement auditing for all connection management activities. | LLM | SKILL.md:20 |
Scan History
Embed Code
[](https://skillshield.io/report/75e2eecc93193db4)
Powered by SkillShield