Composio Connect

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:15 PM UTC
• Version: 1.0.1

Overview

This skill is coherent for connecting Composio apps, but it grants very broad third-party account action capability with limited scoping or confirmation guidance.

Review this before installing. Use it only if you trust the Composio and mcporter setup, can scope the Composio credentials to the accounts and apps you intend to use, and are comfortable with the agent discovering and invoking tools that may read or change data in connected services. Prefer asking for explicit confirmation before any send, post, delete, purchase, calendar, ticket, or account-changing action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned npm Dependency Permits Unreviewed Package Changes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-23
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

The skill declares installation of the mcporter npm package without specifying a reviewed version or integrity hash:

json

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "mcporter",
      "bins": ["mcporter"],
      "label": "Install mcporter (npm)",
    },
  ],

Technical Analysis

An npm package declared only by name is resolved according to the registry state at installation time. Consequently, the installed code can differ from the version originally reviewed with this skill. If the package publisher account, package, or registry delivery path is compromised, a malicious release could be supplied to subsequent installations.

npm packages may define lifecycle scripts that run during installation. They also execute with the permissions of the user performing the installation when their binaries are later invoked. The skill subsequently relies on the installed mcporter executable for MCP configuration, tool discovery, and remote tool calls, increasing the consequences of installing an altered release.

Attack Path

1. An attacker compromises the npm package, its publisher account, or another relevant package-distribution component.
2. The attacker publishes a malicious release under the expected mcporter package name.
3. A user installs the skill dependency without an explicit version or verified integrity value.
4. npm resolves the attacker-controlled release.
5. Malicious code executes through an installation lifecycle script or when the mcporter binary is invoked.
6. The code operates with the installing user's privileges and can access resources available to that process, potentially including the configured Composio environment and local files.

Impact Assessment

Successful exploitation could pe ...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mcporter to an explicitly reviewed, immutable version rather than resolving an unspecified release.
2. Use a lockfile and verify the package with the expected npm integrity hash in controlled installation workflows.
3. Review the package provenance, publisher identity, release signatures or attestations, transitive dependencies, and lifecycle scripts before approving upgrades.
4. Disable npm lifecycle scripts during installation where operationally feasible, then explicitly allow only reviewed setup actions.
5. Perform dependency installation and execution with a least-privileged account or isolated environment.
6. Keep COMPOSIO_API_KEY narrowly scoped and avoid exposing it to installation processes that do not require it.
7. Establish an explicit dependency-update process in which each new version is security-reviewed before the pinned version and integrity metadata are changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description is extremely broad and encourages use for a wide range of common productivity requests across 850+ third-party apps. In an agentic setting, this can cause over-triggering of a powerful skill that performs external side effects, increasing the chance of unintended emails, messages, ticket creation, or document/calendar changes through connected OAuth accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description advertises broad access to third-party SaaS platforms via managed OAuth but does not warn that using the skill may send data to external services or perform actions in connected accounts. This lack of disclosure is dangerous because users and upstream agents may invoke the skill without understanding the privacy, authorization, and real-world action implications.

Content

No source excerpt is available for this finding.