Security Audit
hashnode-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
hashnode-automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Broad access to Hashnode operations via Rube MCP.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Broad access to Hashnode operations via Rube MCP The skill's manifest description and the usage patterns outlined in SKILL.md indicate that the LLM can discover and execute any available Hashnode operation exposed by the Composio Hashnode toolkit via Rube MCP. The skill encourages the use of `RUBE_SEARCH_TOOLS` to find 'TOOL_SLUG_FROM_SEARCH' and then execute it via `RUBE_MULTI_EXECUTE_TOOL`. While the skill itself doesn't hold these permissions, it provides the mechanism for the LLM to access a potentially wide range of actions (e.g., create, update, delete posts, manage users, etc.) without explicit scope limitation within the skill's definition. This broad access, if misused by a compromised or misaligned LLM, could lead to unintended or malicious actions on Hashnode. Consider defining a more granular set of allowed Hashnode operations within the skill's manifest or providing clearer guidance/guardrails for the LLM on which specific operations are intended or require user confirmation, especially for high-impact actions. Alternatively, ensure the underlying Rube MCP and Hashnode toolkit enforce fine-grained permissions and that the LLM is instructed to request user confirmation for sensitive operations. | LLM | SKILL.md |
Scan History
Embed Code
[](https://skillshield.io/report/1f3237294c127da7)
Powered by SkillShield