Ramp Automation
Warn
Audited by Socket on Oct 4, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS. The skill’s Ramp-related capabilities match its stated purpose and there is no malware-like installer behavior, but it routes sensitive finance operations through a remote MCP intermediary and references a discontinued Rube endpoint instead of Composio’s current official MCP service. The main issue is stale/indirect data flow trust, not confirmed malicious intent.
Confidence: 91%Severity: 58%
Audit Metadata