Google Drive (Composio)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:52 AM UTC
• Version: 1.0.0

Overview

This Google Drive skill is purpose-aligned but needs Review because it can mutate and share Drive files while using under-contained local file writes and a disabled remote tool version safety check.

Install only if you trust the Composio connection and the agent environment. Use a Drive account with limited access, confirm every share, move, trash, overwrite, and upload action, avoid broad shared-drive permissions, and prefer running it in a workspace where local file overwrites cannot affect important files. Pin the composio dependency and remove the remote tool version-check bypass before broad or unattended use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Unpinned Composio Dependency Creates Supply-Chain Exposure## Vulnerability Details **File Location**: `SKILL.md`, lines 8–25 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Relevant Code**: ```yaml "requires": { "python": ["composio"] }, ``` ```bash pip install composio ``` ### Technical Analysis The Skill installs the `composio` package without specifying a reviewed version or package-integrity hash. Consequently, installation can resolve to any current release available from the configured Python package repository. The package is imported directly by `google_drive_api.py` and is initialized with the `COMPOSIO_API_KEY`. It also processes the account identifier, Google Drive operation arguments, file metadata, and selected file contents. A compromised or unexpectedly modified dependency release would therefore execute with the same local privileges as the Skill and have access to sensitive runtime information. No evidence indicates that the current `composio` package is malicious. The vulnerability is the absence of dependency controls that would prevent an unreviewed future package version from being installed. ### Attack Path 1. An attacker compromises a future `composio` release or the package-distribution channel. 2. The Skill environment runs `pip install composio` or resolves the dependency from the unpinned metadata. 3. The compromised package executes during installation or when imported. 4. The package reads the Composio API key and account identifier from the process environment. 5. During normal use, it can inspect Drive requests, selected upload content, and returned Drive data. 6. The malicious package can exfiltrate those values or alter requested Drive operations. ### Impact Assessment Successful exploitation would provide code execution with the privileges of the process running the Skill. It could expose the Composio API key, account identifier, selected local upload data, and Google Drive information available th ...[truncated 122 chars]
• Remediation: ## Remediation Suggestions - Pin `composio` to a specific reviewed version in both the Skill metadata and installation instructions. - Use a lockfile or constraints file with cryptographic package hashes. - Install packages with hash verification, such as `pip install --require-hashes`. - Review release notes and security changes before updating the pinned version. - Use a trusted, authenticated package repository or controlled internal mirror. - Run the Skill in a restricted environment with only the filesystem and network access required for its declared functionality.

T09 · Insecure Skill Coding Practices

Warning

• Location: google_drive_api.py:46
• Finding: Composio Tool-Version Safety Validation Is Explicitly Disabled## Vulnerability Details **File Location**: `google_drive_api.py`, lines 46–52 **Vulnerability Type**: Unsafe remote tool configuration **Risk Level**: Medium **Relevant Code**: ```python result = _client().tools.execute( slug=slug, arguments=arguments, user_id=_user_id(), dangerously_skip_version_check=True, ) ``` ### Technical Analysis Every Composio tool invocation sets `dangerously_skip_version_check=True`. This explicitly bypasses the SDK's tool-version compatibility protection. The bypass applies not only to read-only operations but also to security-sensitive and destructive operations, including file uploads, moves, trashing, metadata changes, and permission creation. If the remote tool schema or semantics change, the client may continue sending arguments without detecting incompatibility. Arguments could then be ignored, reinterpreted, or applied with behavior that differs from the reviewed implementation. This setting does not independently prove that Composio will behave maliciously. It removes a defensive boundary intended to detect unexpected remote tool changes. ### Attack Path 1. A Composio Google Drive tool version or schema changes after the Skill is reviewed. 2. The local Skill continues invoking the tool by slug with the previous argument structure. 3. Version compatibility checking is bypassed because `dangerously_skip_version_check` is enabled. 4. A mutating command such as `share`, `move`, `trash`, or `create-file` is submitted. 5. The changed remote tool interprets the old arguments differently or applies new default behavior. 6. The connected Drive account experiences an unintended disclosure or file modification. ### Impact Assessment The impact is bounded by the permissions of the connected Google account and Composio integration. Potential consequences include unintended file sharing, moving or trashing files, uploading content to an incorrect destination, or rec ...[truncated 172 chars]
• Remediation: ## Remediation Suggestions - Remove `dangerously_skip_version_check=True` and retain the SDK's normal compatibility validation. - Pin and explicitly approve Composio tool versions where supported. - Fail closed when the SDK reports a schema or version mismatch. - Validate the expected argument schema and response structure locally. - Apply stricter validation to mutating commands such as `share`, `trash`, `move`, and `update-file`. - Require explicit user confirmation immediately before destructive operations or permission changes. - Add integration tests against the approved remote tool versions before upgrades.

T09 · Insecure Skill Coding Practices

Warning

• Location: google_drive_api.py:75
• Finding: Unrestricted Remote File Retrieval and Caller-Controlled Local File Overwrite## Vulnerability Details **File Location**: `google_drive_api.py`, lines 75–108 **Vulnerability Type**: Unvalidated remote URL and unsafe output path handling **Risk Level**: Medium **Relevant Code**: ```python def _find_file_ref(payload: object, _depth: int = 0) -> str | None: """Walk a Composio response looking for a local path or download URL.""" if _depth > 4: return None if isinstance(payload, str): if payload.startswith(("http://", "https://")) or os.path.exists(payload): return payload return None if isinstance(payload, dict): for key in _FILE_REF_KEYS: ref = _find_file_ref(payload.get(key), _depth + 1) if ref: return ref for key in ("file", "response_data", "data"): ref = _find_file_ref(payload.get(key), _depth + 1) if ref: return ref return None def _save_local(payload: object, dest: str) -> str: """Materialise a Composio file reference at `dest`. Returns the path.""" ref = _find_file_ref(payload) if not ref: raise GoogleDriveAPIError( "save", "No downloadable file reference in the Composio response" ) parent = os.path.dirname(os.path.abspath(dest)) if parent: os.makedirs(parent, exist_ok=True) if ref.startswith(("http://", "https://")): with urllib.request.urlopen(ref) as resp, open(dest, "wb") as fh: shutil.copyfileobj(resp, fh) else: shutil.copyfile(ref, dest) return dest ``` ### Technical Analysis The download helper accepts any string beginning with `http://` or `https://` from the remote Composio response and retrieves it with `urllib.request.urlopen`. It does not validate the hostname, resolved address, redirect destination, response size, or transport security beyond recognizing the URL prefix. Cleartext HTTP is ex ...[truncated 2172 chars]
• Remediation: ## Remediation Suggestions - Require HTTPS and reject all cleartext HTTP references. - Allowlist the documented Composio or approved object-storage hostnames. - Validate every redirect target against the same hostname and protocol policy. - Resolve destination paths with `realpath` and require them to remain under a dedicated workspace download directory. - Reject absolute paths, traversal outside the approved root, and symlink destinations. - Avoid silently overwriting existing files unless the user has explicitly confirmed the operation. - Write to a securely created temporary file and perform an atomic rename after validation. - Apply restrictive file permissions to downloaded content. - Enforce download-size and timeout limits. - Validate local SDK file references against an approved temporary directory before copying them. - Consider validating expected content type and file format before materializing the response.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes a Python script that uses environment variables, writes files to the workspace, and performs networked actions against Google Drive, but the manifest does not declare explicit tool scope such as permissions or allowed-tools. This creates a trust and containment gap: a host agent may permit broader capabilities than a reviewer or runtime policy expects, increasing the risk of unintended data access, export, sharing, or modification through this skill.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When `--save-to` is used, the code downloads remote content or copies a local file reference directly into the destination path, creating parent directories if needed. Although the CLI argument names imply saving, there is no confirmation prompt or runtime disclosure before writing to the local filesystem at this safety-relevant operation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: `create-file` can read arbitrary local content from `--from-file` and send that text to the remote Composio/Google Drive tool via `_execute`. This is a network transmission of local data, but the code provides no explicit user-facing disclosure beyond parameter naming and no warning that local file contents will be uploaded.

Static analysis

No suspicious patterns detected.