ClawHub
Back to skill

Security audit

composio-cli

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Composio CLI integration with meaningful authorization guardrails, though users should review the remote installer and connected-account access before use.

Install this only if you trust Composio and are comfortable letting the agent use connected Composio accounts for requested external-app tasks. Have a trusted operator approve setup and login in a private context, review the remote installer before use on sensitive machines, and keep destructive, public, financial, permission-changing, or bulk actions explicit and tightly bounded.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

External Script Fetching

High
Category
Supply Chain
Content
After the operator authorizes those host changes, run:

```bash
curl -fsSL https://composio.dev/install | sh
```

If execution is not authorized or the environment cannot install software,
Confidence
95% confidence
Finding
The skill instructs the operator to execute a remote installer via `curl ... | sh`, which fetches code from the network and immediately runs it without a separately reviewed local artifact. Even though the text adds operator-authorization and version-check guardrails, this remains dangerous because any compromise of the download endpoint, transport, or installer behavior leads to arbitrary code execution in the host execution environment.

Chaining Abuse

High
Category
Tool Misuse
Content
After the operator authorizes those host changes, run:

```bash
curl -fsSL https://composio.dev/install | sh
```

If execution is not authorized or the environment cannot install software,
Confidence
96% confidence
Finding
The `| sh` construct chains untrusted network content directly into a shell interpreter, removing the opportunity for meaningful inspection before execution. In this skill context, that is especially risky because the document is operational guidance for an agent/operator workflow, so the instruction could normalize unsafe installation behavior on sensitive hosts or sandboxes.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- Prefer reviewed JSON files or stdin for user-controlled structured values.
- Use slugs, toolkit names, and account selectors returned by Composio rather
  than inventing identifiers.
- Do not use `--skip-checks`, `--skip-connection-check`, or
  `--skip-tool-params-check` to force a live action past validation.
- Review `composio run` files before execution and dry-run write workflows when
  supported.
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Transmission

Medium
Category
Data Exfiltration
Content
Use `proxy` only when no dedicated tool covers a known API operation:

```bash
composio proxy https://api.github.com/user \
  --toolkit github \
  --account work \
  --method GET </dev/null
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.