Composio Connect

• Analyzed: May 14, 2026, 4:04 AM
• Findings: 1
• Version: 1.0.1
• Hash: c3a6d84968c05af6fe603445d1215a660ed501650eca6a9cfc85a61780caca77
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its broad capabilities, which, while aligned with its stated purpose, introduce significant security risks. It instructs the agent to install an external npm package (`mcporter`) and execute shell commands, including configuring `mcporter` with a URL from an environment variable (`$COMPOSIO_MCP_URL`). While there is no explicit evidence of intentional malicious behavior like data exfiltration or backdoor installation within the provided files, the ability to install arbitrary packages and make external network calls via `mcporter` (e.g., `mcporter call 'composio.GMAIL_CREATE_DRAFT(...)'`) presents a supply chain risk and a potential attack surface if the `mcporter` package or the `COMPOSIO_MCP_URL` were compromised or manipulated. The `SKILL.md` file contains these instructions.