Security Audit
mailboxlayer-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
mailboxlayer-automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unpinned dependency in manifest.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned dependency in manifest The skill's manifest specifies a dependency on the 'rube' MCP without a version constraint. This means that any future updates to the 'rube' MCP, including potentially breaking changes or security vulnerabilities, would be automatically incorporated without explicit review or pinning to a known safe version. This increases the risk of supply chain attacks or unexpected behavior. Pin the 'rube' MCP dependency to a specific, known-good version in the manifest to ensure deterministic behavior and mitigate risks from upstream changes. For example, `"mcp": ["rube@1.2.3"]` if version pinning is supported by the ecosystem. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/aaa4669122707266)
Powered by SkillShield