Security Audit
Productboard Automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
Productboard Automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unversioned external service dependency (Rube MCP).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unversioned external service dependency (Rube MCP) The skill relies on an external Managed Capability Provider (MCP) at `https://rube.app/mcp`. The manifest specifies `"mcp": ["rube"]` without any versioning or integrity checks. This introduces a supply chain risk, as the behavior of the `rube.app` service is outside the direct control of the skill developer. A malicious or compromised `rube.app` could potentially alter the skill's functionality, exfiltrate data, or perform unauthorized actions through the Productboard API. Implement version pinning or integrity checks for external services. If possible, host critical capabilities locally or use a trusted, versioned MCP. Clearly document the scope of permissions granted to the MCP and the data it can access. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/d9c7d315788e91dd)
Powered by SkillShield