Security Audit
SurveyMonkey Automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
SurveyMonkey Automation received a trust score of 80/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Broad access to sensitive SurveyMonkey data, Unpinned external dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Broad access to sensitive SurveyMonkey data The skill provides extensive access to SurveyMonkey data, including the ability to retrieve all survey responses (`SURVEY_MONKEY_GET_RESPONSES`) which can contain Personally Identifiable Information (PII) such as email addresses, names, and IP addresses. It also allows fetching comprehensive survey details (`SURVEY_MONKEY_GET_SURVEY_DETAILS`) and collector links (`SURVEY_MONKEY_GET_COLLECTORS`), which could expose sensitive survey management URLs. While this is the intended functionality, it represents a high-impact capability that, if misused by a compromised agent or malicious prompt, could lead to significant data exfiltration or unauthorized access. Implement strict access controls and monitoring for agents using this skill. Ensure the host LLM has robust prompt injection defenses to prevent misuse. Consider fine-grained permissions if the underlying API supports it, to limit access to only necessary data fields or specific surveys. | LLM | SKILL.md:97 | |
| MEDIUM | Unpinned external dependency The skill manifest declares a dependency on the "rube" MCP server (`"mcp": ["rube"]`) without specifying a version. The setup instructions also refer to `https://rube.app/mcp`. An unpinned dependency means that updates to the "rube" server could introduce breaking changes, vulnerabilities, or even malicious code without explicit approval or testing, posing a supply chain risk. Pin the "rube" MCP server dependency to a specific, known-good version in the manifest. Regularly review and update dependencies to ensure security and compatibility. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/46f7e70c5d9e93d0)
Powered by SkillShield