Security Audit
kadoa-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
kadoa-automation received a trust score of 92/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Unpinned dependency on Rube MCP, Skill acts as a gateway to broad Rube MCP capabilities.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned dependency on Rube MCP The skill's manifest specifies a dependency on the 'rube' MCP without a version constraint. This means that any future version of the 'rube' MCP could be used, potentially introducing breaking changes, vulnerabilities, or unexpected behavior without explicit review or update of this skill. This poses a supply chain risk. Pin the 'rube' MCP dependency to a specific version or a version range (e.g., `{"mcp": ["rube@1.2.3"]}` or `{"mcp": ["rube@^1.0.0"]}`) in the skill's manifest to ensure stability and security. | LLM | SKILL.md | |
| LOW | Skill acts as a gateway to broad Rube MCP capabilities This skill is designed to leverage the Rube MCP (Meta-Capability Provider) system, which offers dynamic access to a wide array of tools and operations (e.g., `RUBE_MULTI_EXECUTE_TOOL`, `RUBE_REMOTE_WORKBENCH`). While this is the intended functionality for an automation skill, it means the LLM, through this skill, gains access to potentially broad and powerful capabilities provided by Rube. The security posture heavily relies on the internal access controls and sandboxing of the Rube MCP system itself, rather than being defined within this skill package. Ensure that the Rube MCP system has robust access controls, authorization mechanisms, and sandboxing in place for the tools it exposes. Implement strict monitoring and auditing of LLM interactions with powerful Rube tools like `RUBE_MULTI_EXECUTE_TOOL` and `RUBE_REMOTE_WORKBENCH`. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/c7e11410917a2394)
Powered by SkillShield