Security Audit
verifiedemail-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
verifiedemail-automation received a trust score of 96/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Broad Tool Execution Capability, External MCP Dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Broad Tool Execution Capability The skill's 'Quick Reference' section mentions `RUBE_REMOTE_WORKBENCH` with `run_composio_tool()`. While the skill is intended for 'Verifiedemail Automation', the `run_composio_tool()` function is generically named and could potentially be used to execute any Composio tool, not just those related to the 'verifiedemail' toolkit. If the LLM is not sufficiently constrained by its internal reasoning or is manipulated, it could perform actions outside the intended scope of Verifiedemail tasks, leading to excessive permissions. Ensure the LLM's internal logic strictly constrains `run_composio_tool()` calls to only `verifiedemail` toolkit tools. Consider adding explicit instructions within the skill to reinforce this constraint, or if possible, design the `RUBE_REMOTE_WORKBENCH` interface to accept a `toolkit` parameter to enforce this at the tool level. | LLM | SKILL.md:69 | |
| INFO | External MCP Dependency The skill explicitly relies on an external Managed Control Plane (MCP) hosted at `https://rube.app/mcp` and the Composio Verifiedemail toolkit. The security, reliability, and continued operation of this skill are directly dependent on these third-party services. Any compromise or unavailability of `rube.app` or the Composio toolkit could impact the functionality and security of this skill. Acknowledge and monitor the security posture and operational status of the `rube.app` service and Composio toolkits. Implement robust error handling and fallback mechanisms in the LLM's usage of this skill to gracefully manage potential service unavailability or unexpected responses. | LLM | SKILL.md:10 |
Scan History
Embed Code
[](https://skillshield.io/report/00af114152d105cf)
Powered by SkillShield