Security Audit
stannp-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
stannp-automation received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 2 high, 2 medium, and 0 low severity. Key findings include Potential Prompt Injection via Tool Parameters, Data Exfiltration Risk via Broad Tool Access, Excessive Permissions: Broad Stannp API Access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 56/100, indicating areas for improvement.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Data Exfiltration Risk via Broad Tool Access The `RUBE_MULTI_EXECUTE_TOOL` (line 49) allows the agent to execute any discovered Stannp operation. Stannp is a direct mail API, which inherently handles sensitive customer data. If an attacker compromises the agent, they could leverage this broad access to instruct Stannp tools to retrieve sensitive information (e.g., customer lists, campaign data) and potentially exfiltrate it to an external endpoint controlled by the attacker, for example, by sending mail to arbitrary addresses or using webhook functionalities if available through the Stannp API. Implement granular access controls for the agent, limiting the specific Stannp operations it can perform. Restrict the ability to send mail to arbitrary addresses or configure webhooks to untrusted domains. Monitor tool usage for unusual patterns or attempts to access sensitive data. Consider implementing data loss prevention (DLP) measures. | LLM | SKILL.md:49 | |
| HIGH | Unpinned External Dependency (Rube MCP) The skill relies on the Rube MCP service by instructing users to add `https://rube.app/mcp` as an MCP server (line 23). There is no version pinning or integrity check mechanism specified for this dependency. This introduces a significant supply chain risk: if the `rube.app` service is compromised or maliciously updated, the skill's functionality and security could be directly affected without any explicit action or warning to the user or agent. This allows for potential remote code execution or data manipulation through a trusted dependency. Implement version pinning or integrity checks for external dependencies like Rube MCP. If direct URL dependency is unavoidable, consider using a proxy or gateway that can enforce versioning or validate content hashes. Regularly audit the external service for security vulnerabilities and changes in behavior. The platform hosting the skill should ideally provide mechanisms for secure dependency management. | LLM | SKILL.md:23 | |
| MEDIUM | Potential Prompt Injection via Tool Parameters The skill exposes parameters like `use_case` in `RUBE_SEARCH_TOOLS` (line 31) and `arguments` and `memory` in `RUBE_MULTI_EXECUTE_TOOL` (lines 51-52) that accept arbitrary user input. If these inputs are directly fed into an underlying LLM for interpretation or used to construct dynamic queries/commands without proper sanitization, an attacker could craft malicious prompts to manipulate the LLM's behavior, leading to unintended actions or information disclosure. The `use_case` parameter, being natural language, is particularly susceptible. Implement strict input validation and sanitization for all user-controlled parameters passed to Rube tools. If these parameters are used in LLM prompts, ensure robust prompt engineering techniques (e.g., few-shot examples, input delimiters) are applied to mitigate injection risks. Consider whitelisting or constraining natural language inputs where possible. | LLM | SKILL.md:31 | |
| MEDIUM | Excessive Permissions: Broad Stannp API Access The skill grants the agent the ability to dynamically discover and execute any available Stannp tool via `RUBE_SEARCH_TOOLS` (line 28) and `RUBE_MULTI_EXECUTE_TOOL` (line 49). This provides broad, unrestricted access to the entire Stannp API surface. This violates the principle of least privilege, as the agent may not require access to all Stannp functionalities for its intended purpose. A compromised agent could exploit this broad access to perform unauthorized or malicious actions within the Stannp platform. Refine the skill's scope to only expose the minimum necessary Stannp operations required for its intended function. Implement a whitelist of allowed `tool_slug` values or specific argument constraints. If dynamic discovery is essential, ensure that the agent's environment enforces strict runtime policies on what tools can actually be executed. | LLM | SKILL.md:28 |
Scan History
Embed Code
[](https://skillshield.io/report/19b316f91e4948bb)
Powered by SkillShield