ClawHub
Back to skill

Security audit

composio cli

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate Composio integration guide, but it includes unsafe installation guidance and high-impact external-account actions without enough verification and consent safeguards.

Install only after reviewing or replacing the pipe-to-shell installer with a verified package or signed release. Before using the skill, require explicit confirmation for any action that sends messages, posts content, creates issues, deletes connections/configs/triggers, or changes external account state, and avoid logging full tool arguments or trigger payloads.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Mutable Remote Installer Is Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:15-19
  • AGENTS.md:47-50
  • rules/composio-cli.md:16-19

Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippets:

SKILL.md:15-19

bash
## Setup

Check if the CLI is installed; if not, install it:
```bash
curl -fsSL https://composio.dev/install | bash
text

`AGENTS.md:47-50`
```bash
```bash
# Install
curl -fsSL https://composio.dev/install | bash
composio --version   # verify

rules/composio-cli.md:16-19

bash
```bash
# Install
curl -fsSL https://composio.dev/install | bash
composio --version   # verify

Technical Analysis

The command pipes bytes obtained from a remote HTTPS endpoint directly into Bash. This combines retrieval and execution without allowing the user or agent to inspect the payload first. The downloaded script is not included in the audited project and is not pinned by version, checksum, digest, or cryptographic signature.

Consequently, the effective code executed by this Skill can change after the Skill has been reviewed. Although composio.dev is consistent with the declared product, domain alignment alone does not establish the integrity of every future response from the endpoint. HTTPS protects the connection in transit but does not protect against compromise of the origin, deployment pipeline, DNS/account infrastructure, or an unintended change to the installation script.

Direct execution also exceeds the minimum privilege needed to document the installation process. A safer workflow would download a fixed release artifact, verify its authenticity, and request explicit approval before execution.

Attack Path

  1. An agent loads the Skill and determines that the Composio CLI is not installed.
  2. The agent follows the documented installation command.
  3. The remote endpoint, or infrastructure controlling it, returns a modifie ...[truncated 985 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove every curl | bash instruction from SKILL.md, AGENTS.md, and rules/composio-cli.md.
  2. Distribute the CLI through an authenticated package repository or a versioned release artifact.
  3. Pin an exact reviewed version rather than retrieving a mutable installer endpoint.
  4. Download the artifact without executing it:
    bash
    curl -fL --output composio-installer.sh "https://trusted.example/releases/vX.Y.Z/install.sh"
  5. Verify a vendor-published SHA-256 checksum and, preferably, a cryptographic signature from an independently authenticated channel.
  6. Inspect the downloaded script or provide its auditable source in the Skill package before execution.
  7. Require explicit user approval before installing or upgrading software.
  8. Execute installation with ordinary user privileges and avoid requesting sudo unless a documented component strictly requires it.
  9. Fail closed when checksum or signature verification fails.

T08 · Insecure Dependencies

Warning
Location
AGENTS.md:285
Finding

Installation Instructions Resolve Mutable, Unpinned Dependencies

Content
View full analysis

Vulnerability Details

File Locations:

  • AGENTS.md:284-285
  • AGENTS.md:296-297
  • rules/building-with-composio.md:22-23
  • rules/building-with-composio.md:34-35
  • rules/tr-framework-mastra.md:14-18
  • rules/setup-api-keys.md:129-130
  • rules/setup-api-keys.md:145-146

Vulnerability Type: Insecure dependency management
Risk Level: Medium

Complete Code Snippets:

AGENTS.md

bash
```bash
pnpm install @composio/core@latest
text

```bash
```bash
pip install composio
text

`rules/building-with-composio.md`
```bash
**TypeScript**
```bash
pnpm install @composio/core@latest
text

```bash
**Python**
```bash
pip install composio
text

`rules/tr-framework-mastra.md`
```bash
```bash
npm install @mastra/core@latest @ai-sdk/openai @composio/core@latest @composio/mastra@latest

# For MCP (optional)
npm install @mastra/mcp@latest
text

`rules/setup-api-keys.md`
```bash
```bash
npm install dotenv
text

```bash
```bash
pip install python-dotenv
text

### Technical Analysis

These installation commands do not identify an exact reviewed package version. Several commands explicitly select `@latest`, while the unversioned npm and pip commands resolve whatever compatible release is available at installation time.

This prevents reproducible installation and means the dependencies executed by future users may differ from those that existed when the Skill was audited. Package installation can run lifecycle scripts, and imported packages subsequently execute with the application's privileges. A compromised package release or transitive dependency could therefore introduce code not represented in this repository.

The referenced package names are relevant to the Skill's declared functionality, and the audit found no evidence of typosquatting or intentionally malicious package selection. The risk arises from mutable resoluti
...[truncated 1245 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest and unversioned package specifications with exact, reviewed versions.
  2. Commit ecosystem-appropriate lockfiles containing resolved versions and integrity hashes.
  3. Use frozen installation modes in automated environments, such as npm ci, pnpm install --frozen-lockfile, or hash-checked Python requirements.
  4. For Python, generate a locked requirements file with exact versions and hashes, then install with pip install --require-hashes.
  5. Review package provenance, maintainers, release signatures, lifecycle scripts, and transitive dependencies before updating.
  6. Use automated vulnerability and dependency-diff scanning, but require human review for updates to security-sensitive SDKs.
  7. Run package installation in a minimally privileged, isolated build environment without unnecessary production secrets.
  8. Document a controlled update process instead of advising users to resolve the latest release automatically.

T09 · Insecure Skill Coding Practices

Note
Location
rules/app-modifiers.md:115
Finding

Generic Tool Monitoring Logs Complete Argument Payloads Without Redaction

Content
View full analysis

Vulnerability Details

File Location: rules/app-modifiers.md:115-124
Vulnerability Type: Plaintext sensitive-data exposure through logging
Risk Level: Low

Complete Code Snippet:

typescript
const monitor = {
  beforeExecute: ({ toolSlug, params }) => {
    console.log(`[START] ${toolSlug}`, params.arguments);
    return params;
  },
  afterExecute: ({ toolSlug, result }) => {
    console.log(`[END] ${toolSlug} - Success: ${result.successful}`);
    return result;
  },
};

Technical Analysis

The monitoring example writes the complete params.arguments object to standard output before every tool execution. This is a generic hook and applies irrespective of the selected tool or the sensitivity of its input schema.

In the Skill's declared Gmail, Slack, GitHub, authentication, and external-service workflows, arguments may contain message bodies, recipients, repository data, personal information, bearer values, passwords, API keys, or other confidential content. The nearby sensitive-result filtering example does not protect this pre-execution log because it only deletes selected fields from returned result data.

Logging payloads to the console can also forward them into container logs, serverless logs, CI output, or centralized observability platforms. Those systems commonly have broader readership and longer retention than the original application request.

Attack Path

  1. A developer copies the documented monitor modifier into an application.
  2. A user or agent invokes a tool with confidential values in params.arguments.
  3. The beforeExecute hook serializes or renders the complete argument object to standard output.
  4. The deployment platform captures that output in application or centralized logs.
  5. A person or service with log access retrieves information that was not intended for that audience.

Impact Assessment

The issue can disclose sensitive tool inputs ...[truncated 512 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not log complete tool argument objects by default.
  2. Log an allowlisted set of operational metadata, such as the tool slug, request identifier, duration, and success status.
  3. Implement recursive redaction for keys such as authorization, token, access_token, secret, password, api_key, cookie, and provider-specific credential fields.
  4. Treat free-form message bodies and document contents as sensitive even when their field names do not resemble credentials.
  5. Make payload logging an explicit development-only option and ensure it is disabled in production.
  6. Apply access controls, encryption, retention limits, and deletion policies to centralized logs.
  7. Add tests that verify representative nested secrets and personal data never appear in emitted log records.
  8. Replace the example with a safe pattern:
    typescript
    const monitor = {
  beforeExecute: ({ toolSlug, params }) => {
    console.log('[START]', {
      toolSlug,
      argumentNames: Object.keys(params.arguments ?? {}),
    });
    return params;
  },
  afterExecute: ({ toolSlug, result }) => {
    console.log('[END]', {
      toolSlug,
      successful: result.successful,
    });
    return result;
  },
};

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (52)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill recommends installing software by piping a remotely fetched script directly into bash. This is dangerous because it executes unreviewed network content immediately, enabling supply-chain compromise, man-in-the-middle abuse, or malicious server-side changes to result in arbitrary code execution on the host.

Content

Scanner excerpt · AGENTS.md (reported line 49)May include surrounding context.

bash
# Install
curl -fsSL https://composio.dev/install | bash
composio --version   # verify

# Authenticate

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash construct creates an unsafe execution chain where data from an external URL becomes shell commands without validation. In an agent setting, this is especially risky because the agent may follow the instruction non-interactively, turning a documentation shortcut into direct arbitrary code execution.

Content

Scanner excerpt · AGENTS.md (reported line 49)May include surrounding context.

bash
# Install
curl -fsSL https://composio.dev/install | bash
composio --version   # verify

# Authenticate

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The command fetches a shell script from an external domain and executes it immediately, creating a direct arbitrary code execution path. Because this skill targets agent/tooling workflows, the command may be copied into privileged developer or automation environments, increasing blast radius if the fetched content is malicious or altered.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Check if the CLI is installed; if not, install it:

bash
curl -fsSL https://composio.dev/install | bash

After installation, restart your terminal or source your shell config, then authenticate:

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The shell pipeline into bash removes any review boundary between network content and code execution, which is a classic chaining-abuse pattern. If the upstream response is modified, the local shell will execute attacker-controlled commands immediately, potentially compromising credentials, source code, or the system itself.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Check if the CLI is installed; if not, install it:

bash
curl -fsSL https://composio.dev/install | bash

After installation, restart your terminal or source your shell config, then authenticate:

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to pipe a remotely fetched script directly into bash, which executes untrusted network content without prior inspection or integrity verification. If the install endpoint, transport, DNS, or hosting is compromised, arbitrary code would run immediately in the user's shell environment.

Content

Scanner excerpt · rules/composio-cli.md (reported line 18)May include surrounding context.

bash
# Install
curl -fsSL https://composio.dev/install | bash
composio --version   # verify

# Authenticate

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash pattern is a classic command-chaining risk because it turns fetched content into immediate shell execution, eliminating any review boundary. In this skill's context, which is explicitly designed for agents to take actions on external apps, normalizing this pattern makes autonomous compromise more dangerous if the fetched script is malicious or altered.

Content

Scanner excerpt · rules/composio-cli.md (reported line 18)May include surrounding context.

bash
# Install
curl -fsSL https://composio.dev/install | bash
composio --version   # verify

# Authenticate

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/setup-api-keys.md (reported line 108)May include surrounding context.

openai = OpenAI(api_key=os.environ["OPENAI_API_KEY"]) # ✅ Secure

text

## Complete .env File Example

```bash
# Composio Configuration

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/setup-api-keys.md (reported line 161)May include surrounding context.

openai = OpenAI(api_key=os.environ["OPENAI_API_KEY"]) # ✅ Secure

text

## Complete .env File Example

```bash
# Composio Configuration

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/setup-api-keys.md (reported line 162)May include surrounding context.

text
   # .gitignore
   .env
   .env.local
   .env.*.local

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · rules/tr-session-lifecycle.md (reported line 314)May include surrounding context.

md
manageConnections: true
  });

  // 2. Log session start
  logger.info('Session started', {
    sessionId: session.sessionId,
    userId,

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · rules/tr-session-lifecycle.md (reported line 326)May include surrounding context.

md
manageConnections: true
  });

  // 2. Log session start
  logger.info('Session started', {
    sessionId: session.sessionId,
    userId,

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

The error log includes the raw error object alongside sessionId, which can unintentionally serialize sensitive context such as request payloads, tool arguments, stack traces, endpoints, or provider responses. In an agent/tool-routing skill that brokers access to external apps, error objects often contain high-value operational data, making this more dangerous than ordinary tracing.

Content

Scanner excerpt · rules/tr-session-lifecycle.md (reported line 333)May include surrounding context.

md
return response;
  } catch (error) {
    // 5. Log session error
    logger.error('Session failed', {
      sessionId: session.sessionId,
      error

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill instructs the agent to perform high-impact actions on third-party services such as sending email, posting messages, and creating issues, but it does not include an explicit warning that these actions transmit user data externally and may cause irreversible side effects. In an agent-skill context, this increases the chance of silent or insufficiently-consented external actions, especially because the skill is framed as a direct operational guide.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented command for deleting a connected account is destructive and potentially irreversible, yet it appears without a strong warning or confirmation guidance. In a tool-using agent workflow, this omission can lead to accidental removal of integrations or user access, causing service disruption or loss of configuration state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill encourages taking actions against third-party services such as Gmail, Slack, GitHub, and Notion, but it does not warn that these operations can modify external accounts, send messages, or expose user data. In an agent context, missing consent and impact disclosure increases the risk of unintended or unauthorized actions being performed on connected accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructions tell users to pipe a remote script directly into bash without any verification, review, or warning. This is dangerous because a compromised vendor site, CDN, DNS path, or MITM in some environments could deliver arbitrary shell commands that execute immediately on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation includes example code that places sensitive values such as client_secret and api_key inline in source snippets without an explicit warning about secret handling, storage, logging, or exposure. In an auth-configuration skill, users may copy these patterns directly into code, CI/CD pipelines, or shared repos, which can lead to credential leakage and unauthorized access to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation provides a ready-to-use authenticated GitHub action that performs a state-changing operation (PUT /user/starred/...) against a user's external account, but it does not clearly warn that invoking the tool will modify account state. In an agent/tooling context, examples strongly influence implementation and usage, so omission of an explicit side-effect warning can lead to unintended actions on behalf of users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The example shows direct insertion of an access token into an HTTP Authorization header using connectionConfig.val?.access_token without any surrounding credential-handling guidance. Although this is a common pattern, documentation that normalizes raw token handling without warning increases the risk of insecure copying, accidental logging, misuse across domains, or transmission to unintended endpoints in downstream implementations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/app-custom-tools.md (reported line 93)May include surrounding context.

md
repo: z.string().describe('Repository name'),
  }),
  execute: async (input, connectionConfig) => {
    const response = await fetch(`https://api.github.com/repos/${input.repo}`, {
      headers: {
        Authorization: `Bearer ${connectionConfig.val?.access_token}`,
      },

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · rules/app-fetch-tools.md (reported line 223)May include surrounding context.

md
version: '12082025_00'
});

// DON'T: Use hardcoded versions without checking
const result = await composio.tools.execute('GITHUB_GET_REPO', {
  userId: 'user_123',
  arguments: { owner: 'composio', repo: 'sdk' },

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · rules/app-fetch-tools.md (reported line 240)May include surrounding context.

md
version: '12082025_00'
});

// DON'T: Use hardcoded versions without checking
const result = await composio.tools.execute('GITHUB_GET_REPO', {
  userId: 'user_123',
  arguments: { owner: 'composio', repo: 'sdk' },

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation demonstrates retrieval of OAuth configuration fields including client_secret without warning that these are sensitive credentials requiring secure handling. In an agent/integration context, developers may log, persist, or expose these secrets insecurely, increasing the risk of account takeover or unauthorized API access if credentials are leaked.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document explicitly states at L012 and again at L180 that toolkits.get() returns an array and should not be accessed via .items. However, the example at L142 uses toolkits.items.map(...), which directly contradicts the stated API behavior and can mislead developers about the skill's actual interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file explicitly tells users to run composio init to initialize and store an API key, but it does not disclose where the credential is stored, how it should be protected, or any privacy/security implications. Because this involves handling sensitive credentials, the skill description should include a clear warning or brief note about secure storage and avoiding accidental exposure.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
rules/app-auth-configs.md:106

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
rules/setup-api-keys.md:66

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
rules/tr-framework-integration.md:414