Trust Assessment
fomo-automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Unpinned MCP Dependency, Broad Tool Orchestration via Rube MCP.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned MCP Dependency The skill's manifest specifies a dependency on the 'rube' MCP without a version constraint. This means the skill will always use the latest available version of the 'rube' MCP, which could lead to unexpected behavior, breaking changes, or introduce vulnerabilities if a malicious update is pushed to the 'rube' MCP without explicit user consent or review. Specify a precise version for the 'rube' MCP dependency in the `requires` field (e.g., `{"mcp": {"rube": "1.2.3"}}`) to ensure stability and prevent unexpected changes from upstream updates. | LLM | SKILL.md | |
| LOW | Broad Tool Orchestration via Rube MCP The skill relies on the `rube` MCP, which provides a `RUBE_MULTI_EXECUTE_TOOL` capable of executing any Fomo operation discovered via `RUBE_SEARCH_TOOLS`. This design grants the skill broad access to all functionalities exposed by Fomo through the Rube MCP. While this is inherent to the skill's purpose of automating Fomo tasks, users should be aware that granting this skill access to Rube MCP effectively grants it the ability to perform a wide range of Fomo operations, potentially including sensitive actions, depending on Fomo's capabilities. Users should carefully review the specific Fomo operations that the Rube MCP exposes and understand the implications of granting broad access. Skill developers should consider if a more granular permission model is possible within the Rube MCP or Fomo ecosystem, or if the skill's scope can be narrowed to reduce potential impact. | LLM | SKILL.md:50 |
Scan History
Embed Code
[](https://skillshield.io/report/c4ea86d2aff5d2b6)
Powered by SkillShield