Security Audit
vestaboard-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
vestaboard-automation received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned external dependency and dynamic tool discovery from third-party service, Broad access to external service operations.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned external dependency and dynamic tool discovery from third-party service The skill relies entirely on the Rube MCP (rube.app) for Vestaboard automation. The skill's instructions imply an unversioned dependency on Rube MCP, meaning updates to the external service could introduce breaking changes or vulnerabilities without explicit review. Furthermore, the skill instructs the LLM to dynamically discover tools and their schemas via `RUBE_SEARCH_TOOLS` from this external service. A compromise of the Rube MCP service could lead to the LLM being instructed to execute malicious or unintended operations based on compromised tool definitions. Implement version pinning for external dependencies if the platform allows. Consider implementing a mechanism to validate tool schemas fetched from external services. Clearly document the security implications of relying on a third-party service for dynamic tool definitions and ensure robust LLM-side validation of tool outputs and actions. | LLM | SKILL.md:5 | |
| MEDIUM | Broad access to external service operations The skill instructs the LLM to use `RUBE_SEARCH_TOOLS` to discover and then execute 'Vestaboard operations' via `RUBE_MULTI_EXECUTE_TOOL`. This grants the LLM broad, dynamic access to potentially any operation exposed by the Vestaboard toolkit through Rube MCP. Without specific constraints or a whitelist of allowed operations, this could lead to unintended or unauthorized actions on the Vestaboard if the LLM is prompted maliciously or makes an error. If possible, define a more granular set of required Vestaboard operations in the skill's manifest or provide explicit guidance to the LLM to only use specific, whitelisted tools or operations. Implement LLM-side guardrails to prevent execution of sensitive or destructive operations without explicit user confirmation. | LLM | SKILL.md:39 |
Scan History
Embed Code
[](https://skillshield.io/report/84823ff53055745b)
Powered by SkillShield