ClawHub
Back to skill

Security audit

Composio Integration

Security checks across malware telemetry and agentic risk

Overview

This is a real Composio Gmail/Tasks integration, but it publishes live-looking credentials and account identifiers while enabling sensitive email and task actions.

Review carefully before installing. Do not use the embedded API key or account IDs; treat them as compromised. Prefer a revised version that removes personal identifiers, requires your own scoped credentials, limits allowed tools/accounts, and asks for explicit confirmation before sending email, deleting email, or bulk-changing tasks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The script exposes a generic capability to execute any Composio action specified at runtime, with no allowlist, purpose restriction, or validation of which remote operations are permitted. In an agent skill context, this is dangerous because it can be repurposed to trigger sensitive third-party actions such as sending messages, modifying documents, or accessing external services beyond an intended narrow use case.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This skill documents active Gmail and Google Tasks capabilities, including read, send, update, and delete operations, without any warning about privacy exposure, destructive actions, or the need for explicit user confirmation. The risk is heightened because the same file also exposes a live API key and connected account identifiers, making the documented destructive capabilities immediately actionable rather than hypothetical.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The examples show how to send email and invoke tooling that can delete or alter mailbox/task data, but they do not include warnings about irreversible actions, privacy implications, or confirmation requirements. In context, this is more dangerous because the examples include real credentials and account IDs, so a user or agent could directly perform harmful actions against a real mailbox and task account.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script performs arbitrary remote actions immediately based on caller-supplied app/action/JSON input, without any confirmation step, safety interlock, or warning for destructive operations. In practice, this enables accidental or malicious invocation of side-effecting actions like data modification, deletion, or outbound communication through connected integrations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script sends a hard-coded connected Gmail account identifier and search request to a third-party API endpoint without any access control checks, user consent flow, or validation that the caller is authorized to query that mailbox. In an agent-skill context, this is dangerous because it operationalizes email access and metadata retrieval in a way that could silently expose private mailbox contents if the environment provides a valid API key and connected account.

External Transmission

Medium
Category
Data Exfiltration
Content
echo ""

# Execute the action via Composio API
RESPONSE=$(curl -s -X POST "https://backend.composio.dev/api/v1/actions/$ACTION/execute" \
  -H "X-API-Key: $COMPOSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"input\": $PARAMS}")
Confidence
86% confidence
Finding
curl -s -X POST "https://backend.composio.dev/api/v1/actions/$ACTION/execute" \ -H "X-API-Key: $COMPOSIO_API_KEY" \ -H "Content-Type: application/json" \ -d

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/execute-tool.mjs:3

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/list-tools.mjs:3

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:50