Security Audit
epic-games-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
epic-games-automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Generic Tool Execution Grants Broad External Service Access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Generic Tool Execution Grants Broad External Service Access The skill instructs the LLM to use `RUBE_MULTI_EXECUTE_TOOL` to execute any tool slug discovered via `RUBE_SEARCH_TOOLS` for 'Epic Games operations'. This pattern grants the LLM broad, unconstrained access to the capabilities exposed by the `epic_games` toolkit through Rube MCP. While the initial search query attempts to scope the tools, the `RUBE_MULTI_EXECUTE_TOOL` itself is a generic executor, meaning the LLM can perform any action available through the toolkit, potentially including sensitive or destructive operations, without further permission checks or granular control defined within the skill. This violates the principle of least privilege by enabling overly broad tool access to an external service, creating a risk if the LLM's reasoning is compromised. Implement fine-grained access control within the `epic_games` toolkit or Rube MCP to limit the scope of operations available to the LLM. Alternatively, design skills to use more specific, purpose-built tools rather than generic executors for sensitive operations. Ensure the LLM's reasoning process is robust enough to only select tools strictly necessary for the user's intent and to avoid potentially destructive actions. | LLM | SKILL.md:50 |
Scan History
Embed Code
[](https://skillshield.io/report/4ef40f1cd8460cf7)
Powered by SkillShield