Security Audit
PhantomBuster Automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
PhantomBuster Automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential SSRF and Data Exfiltration via Proxy Parameter.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential SSRF and Data Exfiltration via Proxy Parameter The `PHANTOMBUSTER_POST_HCAPTCHA` tool, as described in the skill documentation, accepts a `proxy` parameter. If an attacker can manipulate the LLM to provide an internal network address or an attacker-controlled proxy URL for this parameter, it could lead to Server-Side Request Forgery (SSRF) or data exfiltration. SSRF could allow probing of internal networks, while an attacker-controlled proxy could intercept data sent through it, including the hCaptcha request itself or any sensitive information the LLM might be prompted to include in other parameters (e.g., `userAgent`). Implement strict validation and sanitization for the `proxy` parameter. Consider restricting its use to a predefined allowlist of trusted proxy services or disallowing arbitrary proxy URLs if not strictly necessary. If arbitrary proxies are required, ensure all requests are routed through a secure, isolated environment with robust egress filtering to prevent access to internal resources and block communication with known malicious endpoints. | Static | SKILL.md:77 |
Scan History
Embed Code
[](https://skillshield.io/report/115957a44e976a9e)
Powered by SkillShield