Composio Composer Xskill

What to check before installing: - Source and trust: The skill's Source/Homepage are unknown; prefer skills from a known publisher. Review the bundled code yourself or run it in an isolated environment before granting real credentials. - Metadata mismatch: The registry declares no required env vars but SKILL.md and config.py expect multiple COMPOSIO_* secrets. Treat that as a red flag and verify which variables the runtime actually needs. - README vs. API mismatch: README examples omit an auth token while __init__.py and SKILL.md show a composio_auth_token parameter and config.py reads env vars. Ensure you know whether you must pass tokens in calls or rely on env vars. - .env handling: Docs recommend python-dotenv but the code does not call load_dotenv() (config.py uses os.getenv). If you plan to use a .env file, you must load it yourself; storing tokens in plaintext files has risk — store secrets securely and limit file permissions. - Least privilege & rotation: Create and use Composio credentials with minimal permissions, and be prepared to rotate tokens if you install/remove the skill. - Network endpoints: The default api base is https://backend.composio.dev/api/v1 — confirm this is the correct and expected endpoint for your account. - If unsure, ask the publisher for clarification (who maintains the skill), or run the code in a sandbox and inspect network traffic before providing production credentials.