Security Audit

simple-analytics-automation

github.com/ComposioHQ/awesome-claude-skills

AI SkillCommit 27904475d127

TRUSTED

Scanned about 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

simple-analytics-automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Skill exposes generic tool execution beyond stated scope.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Shell Execution

1 finding

Excessive Permissions

1 finding

Security Findings1

Severity	Finding	Layer	Location
HIGH	Skill exposes generic tool execution beyond stated scope The skill's stated purpose is 'Automate Simple Analytics tasks'. However, it exposes the `RUBE_REMOTE_WORKBENCH` tool with the capability to `run_composio_tool()`. This tool is described as handling 'Bulk ops' and its generic name suggests it can execute any Composio tool. If `run_composio_tool()` is not strictly scoped to Simple Analytics operations, this grants the LLM excessive permissions, allowing it to perform actions outside the intended domain of the skill, potentially leading to unauthorized data access or manipulation in other integrated systems. 1. Clarify the scope of `RUBE_REMOTE_WORKBENCH` and `run_composio_tool()` in the skill documentation to explicitly state any limitations to Simple Analytics operations. 2. If `run_composio_tool()` can execute tools beyond Simple Analytics, evaluate if this broad capability is truly necessary for a skill focused solely on 'Simple Analytics automation'. 3. Implement platform-level restrictions to ensure that `run_composio_tool()` invoked by this skill is strictly limited to Simple Analytics tools or a predefined, minimal set of necessary operations.	LLM	SKILL.md:71

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/ba2b5452aa681302.svg)](https://skillshield.io/report/ba2b5452aa681302)