Composio Connect

• Risk level: Low
• Analyzed: Feb 16, 2026, 9:53 PM
• Findings: 0
• Version: 1.0.1

Overview

The skill's requests (mcporter binary + Composio API URL/key and an npm install) match its stated purpose of brokering calls to many third‑party apps; nothing requested appears unrelated or disproportionate.

Before installing: verify the mcporter npm package is the official/expected package and pin a known-good version; confirm COMPOSIO_MCP_URL points to a trusted Composio endpoint (e.g., your organization’s composio instance or composio.dev) before supplying COMPOSIO_API_KEY; expect that any text/content you pass to mcporter call will be transmitted to that external MCP server (so avoid sending highly sensitive secrets); review mcporter package source or vendor docs if you need stronger assurance; consider testing in an isolated account or environment and rotate the API key after initial use.