composio cli

• Outcome: Review
• Latest audit: May 28, 2026 · 3:46 AM UTC
• Version: 1.0.0

Overview

This skill is a legitimate Composio integration guide, but it gives agents broad authority over external accounts with too little consent, approval, and sensitive-data handling guidance.

Install only if you are comfortable letting Composio connect to third-party accounts and execute actions through agents. Require explicit approval before linking accounts, sending messages, creating issues, deleting resources, enabling triggers, or using approval-bypass examples; also redact logs and avoid sending raw tool inputs, outputs, callback parameters, or webhook payloads to analytics.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (29)

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill explicitly instructs agents to execute real actions on third-party services such as sending email, posting messages, and creating issues, but it does not pair those capabilities with a clear requirement for user confirmation before state-changing operations. In an agent setting, that omission increases the chance of unintended or unauthorized actions against external accounts, especially because the skill is framed as suitable for direct agent use.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation includes a deletion command for connected accounts without clearly labeling it as destructive or warning about service disruption, loss of access, or accidental account unlinking. In a skill intended for agent use, examples are often copied directly, so an unguarded destructive command materially raises misuse risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent/user to install software, authenticate to third-party services, and execute actions against external apps without any explicit warning about privacy, credential scope, side effects, or the need for user confirmation. In an agent context, this increases the risk of unintended account linking, data access, or actions performed on behalf of a user without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation shows custom OAuth and API key examples with inline placeholder secrets but does not warn against hardcoding credentials, storing them in source control, or exposing them in logs and client-side code. In an auth configuration management skill, users are especially likely to copy these snippets into production automation, which can lead to credential leakage and unauthorized access if secrets are handled insecurely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guidance encourages collecting and returning all callback query parameters from an auth popup flow without warning that those parameters may contain sensitive values such as state, connection identifiers, temporary codes, or error details. In a real integration, developers may log, persist, or propagate this full parameter object, increasing the chance of credential leakage, account-linking abuse, or exposure of sensitive auth metadata through frontend logs, analytics, or browser history.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation includes a ready-to-use authenticated example that performs a state-changing GitHub action (`PUT` to star a repository) but does not clearly warn that executing it will modify a user's external account state. In an agent-skill context, examples are often copied directly into production flows, so lack of an explicit side-effect warning increases the chance of unintended actions against a connected account.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The logging example prints `params.arguments` directly, which can include secrets, personal data, or other sensitive tool inputs. In a skill focused on external app/tool execution, users may copy this pattern into production and unintentionally send credentials or confidential data to logs, where retention and broader access make exposure more likely.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This guide explicitly instructs agents to search, connect accounts, and execute actions on behalf of users, but it does not include a clear requirement to obtain user confirmation before performing side-effecting operations. In an agent context, that omission increases the chance of unintended emails, ticket creation, account linking, or other external actions that affect user data and third-party systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The examples show account linking and direct execution of actions such as sending email and creating GitHub issues without an explicit caution to confirm user intent first. Because this skill is designed for agents acting on external apps, these examples could normalize autonomous execution of high-impact actions and lead to unauthorized or mistaken operations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The rule promotes automatic in-chat OAuth connection management for external services like Gmail and Slack, but it does not clearly warn users that authenticating will grant the agent access to third-party account data and capabilities. In a chat-driven flow, this omission can lead to users authorizing sensitive integrations without informed consent, increasing the risk of unintended data exposure or overbroad tool access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The example enables Gmail/Slack tools and passes arbitrary prompts into an agent without any notice, consent flow, or guidance about what data may be sent to external providers and third-party apps. In practice, developers may copy this pattern directly, causing sensitive user content or connected account data to be processed or transmitted without adequate transparency or minimization.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The React/API example forwards `messages` and `userId` directly into tool-enabled processing, which can expose chat contents and account-linked data to external services without any privacy notice or server-side validation guidance. Because this is a reusable app pattern, developers may deploy it as-is and inadvertently process personal or sensitive data beyond user expectations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly shows passing an API key in MCP headers and later includes examples using approval-bypass settings, but it does not warn readers not to hardcode secrets, expose session headers, or disable approvals only in tightly controlled contexts. In an integration guide for AI agents and external tools, omission of these safety notes materially increases the chance that developers will copy insecure patterns into production.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The logging section encourages before/after execution telemetry but does not warn that tool parameters and results may contain emails, tokens, message bodies, or other user data. Because this skill is specifically about routing Gmail/Slack and similar external app data through agent tools, readers are likely to log sensitive content unintentionally.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation encourages connecting Gmail and Slack tools but does not warn that agent prompts, message content, and retrieved data may be sent to third-party services and external APIs. In an agent-integration skill, this omission can lead developers to expose sensitive communications or customer data without informed consent, minimization, or policy controls.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The sample uses an environment-sourced API key but gives no guidance on secret handling, rotation, or preventing accidental exposure in logs, client code, or repositories. While using environment variables is standard, security documentation for an integration skill should still warn that these credentials grant access to external services and must be protected.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guidance explicitly shows sending raw tool parameters to analytics (`params`) during telemetry without any warning about redaction, minimization, consent, or handling of sensitive data. In this skill's context, tool parameters may include email contents, search queries, recipient addresses, tokens, or other user/business data from apps like Gmail and Slack, so copy-pasting this example could leak sensitive information into third-party observability systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The example performs bulk deletion of triggers in a loop without recommending any confirmation, dry-run, scoping validation, or recovery mechanism. In a trigger-management skill, this can cause accidental or unauthorized mass removal of event subscriptions, leading to service disruption, missed events, and difficult recovery if the trigger definitions are not easily reconstructable.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The account disconnection workflow presents permanent deletion as an option immediately after listing triggers, but does not strongly warn against irreversible loss or advise confirmation and retention policies. Because this skill manages external app integrations and trigger lifecycles, an operator or agent could remove all triggers for an account during a transient disconnect, causing silent loss of automation and event processing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example logs full trigger payloads plus user and connected account identifiers, which may contain sensitive personal or business data. In documentation, this is risky because developers often copy examples verbatim into local or shared environments, causing unnecessary exposure in terminal history, log aggregators, screenshots, or support artifacts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The production webhook example logs the entire received event without warning, which can leak sensitive event contents in server logs. In a production context this is more dangerous than the development example because webhook traffic may include real customer data and logs are often retained, centralized, and accessible to broader teams.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The example code logs `event.userId` and the full `event.payload`, which may contain sensitive personal, account, or message data from upstream integrations. Because this is documentation for production webhook handling, developers may copy the pattern directly into real systems, leading to unnecessary retention or exposure of sensitive webhook contents in application logs.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The TypeScript example logs full tool parameters and execution results with JSON.stringify(params) and result metadata, which can capture credentials, message contents, recipient data, and other sensitive information. In agent-tool integrations, logs are often centralized and broadly accessible, so this creates a realistic data leakage path.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The Python example prints raw tool arguments and response data directly to stdout, which can expose user prompts, email contents, access tokens, or other connected-app data. Since the guide promotes use with Gmail and Slack, the context makes accidental disclosure more likely and more harmful than in a generic toy example.

Context Leakage

High

• Category: Data Exfiltration

Content

return response;
  } catch (error) {
    // 5. Log session error
    logger.error('Session failed', {
      sessionId: session.sessionId,
      error

• Confidence: 84% confidence
• Finding: Logging the raw error object can leak sensitive context because exceptions often contain request payloads, tool inputs, stack traces, tokens, URLs, or downstream service responses. In an agent/tool-routing system that interacts with external apps, error paths are especially likely to include user data or connector-specific secrets, making unrestricted error logging a real information disclosure risk.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: rules/app-auth-configs.md:106

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: rules/setup-api-keys.md:66

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: rules/tr-framework-integration.md:414