Security Audit
mailsoftly-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
mailsoftly-automation received a trust score of 89/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Unpinned Rube MCP dependency, Reliance on external Rube MCP service.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Rube MCP dependency The skill's manifest specifies a dependency on the 'rube' MCP without a specific version. This means that any version of the 'rube' MCP could be used, potentially introducing unexpected behavior, breaking changes, or security vulnerabilities if a malicious or flawed update to 'rube' is released. Without version pinning, the skill's behavior is not deterministic and could change without explicit review. Specify a precise version or version range for the 'rube' MCP dependency in the `requires` field of the manifest (e.g., `{"mcp": ["rube==1.2.3"]}` or `{"mcp": ["rube>=1.0.0,<2.0.0"]}`) to ensure deterministic behavior and mitigate risks from unvetted updates. | LLM | SKILL.md | |
| MEDIUM | Reliance on external Rube MCP service The skill's core functionality is entirely dependent on an external Rube MCP service, with documentation instructing users to connect to `https://rube.app/mcp`. This introduces a supply chain risk where the security and integrity of the `rube.app` domain and its hosted service are critical. A compromise of this external service could directly impact the security of operations performed through this skill, as all tool calls are routed through it. Users should be made aware of the trust placed in `rube.app` and its security practices. For skill developers, consider documenting the security measures taken by the external service provider or exploring options for self-hosting or verifying the integrity of the external service if applicable. | LLM | SKILL.md:20 |
Scan History
Embed Code
[](https://skillshield.io/report/45bb5e4d12ada6da)
Powered by SkillShield