Security Audit
onesignal-rest-api-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
onesignal-rest-api-automation received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Broad Execution Capabilities via RUBE_REMOTE_WORKBENCH, Dynamic Execution of Undefined Tools Grants Excessive Permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Broad Execution Capabilities via RUBE_REMOTE_WORKBENCH The skill explicitly recommends using `RUBE_REMOTE_WORKBENCH` for 'Bulk ops' and mentions `run_composio_tool()`. This terminology ('workbench', 'run_composio_tool', 'bulk ops') strongly suggests the ability to execute complex, potentially arbitrary, operations or code within the Rube MCP environment. If `run_composio_tool()` allows the execution of arbitrary commands, scripts, or highly privileged operations without strict sandboxing and input validation, it constitutes a critical command injection vulnerability. Even if restricted to Composio tools, the 'bulk ops' capability implies a very broad and powerful execution surface that could be misused by a malicious prompt. Clarify the exact capabilities and limitations of `RUBE_REMOTE_WORKBENCH` and `run_composio_tool()`. Ensure that `run_composio_tool()` is strictly sandboxed and does not allow arbitrary code execution. If it does, implement robust input validation and restrict its use to predefined, safe operations. Consider if such a powerful, general-purpose execution tool is necessary for a specific skill, or if its scope can be significantly narrowed. | LLM | SKILL.md:60 | |
| HIGH | Dynamic Execution of Undefined Tools Grants Excessive Permissions The skill instructs the LLM to dynamically discover tools using `RUBE_SEARCH_TOOLS` and then execute them via `RUBE_MULTI_EXECUTE_TOOL` using `tool_slug` and `arguments` derived from the search results. This grants the LLM broad permissions to execute any tool available through Rube MCP for the `onesignal_rest_api` toolkit, and potentially other toolkits if the search query is manipulated. This dynamic execution model, without explicit whitelisting of specific tool slugs or strict validation of arguments, presents a significant attack surface. A malicious prompt could instruct the LLM to search for and execute unintended or harmful tools if they become available through Rube MCP (e.g., due to a supply chain compromise of Rube MCP or its integrated tools). Implement a strict whitelist of allowed `tool_slug` values that the LLM can execute. Ensure that `arguments` passed to `RUBE_MULTI_EXECUTE_TOOL` are rigorously validated against the expected schema and do not allow for injection of malicious data or commands. Consider adding a human-in-the-loop approval for execution of newly discovered or particularly sensitive tools, especially when the `tool_slug` is not explicitly whitelisted. | LLM | SKILL.md:38 |
Scan History
Embed Code
[](https://skillshield.io/report/4deea9cdb61fc4b2)
Powered by SkillShield