Security Audit
wave_accounting-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
wave_accounting-automation received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Broad access to sensitive financial operations and connection management.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Broad access to sensitive financial operations and connection management The skill enables the LLM to perform a wide range of operations within Wave Accounting, including managing invoices, customers, and payments. It explicitly instructs the LLM to use `RUBE_MANAGE_CONNECTIONS` for connection management and `RUBE_MULTI_EXECUTE_TOOL` for executing discovered Wave Accounting tools. This grants significant control over sensitive financial data and the ability to modify it, as well as the ability to manage the authentication state. If misused by the LLM or a malicious prompt, this could lead to unauthorized financial transactions, data manipulation, or service disruption. Implement strict LLM guardrails and human-in-the-loop approvals for sensitive financial operations. Limit the LLM's ability to autonomously call `RUBE_MANAGE_CONNECTIONS` or require explicit user confirmation for connection changes. Ensure the Rube MCP system has robust access controls and auditing for `RUBE_MANAGE_CONNECTIONS` and `RUBE_MULTI_EXECUTE_TOOL` calls. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/7e316f8f3dbd4971)
Powered by SkillShield