Composio Integration

Access and manage Gmail emails and Google Tasks via Composio's unified API with tools for sending, searching, creating tasks, and more.

Security Scan

The bundle appears to be a real Composio integration, but it contains hard-coded credentials and connected-account details and has several mismatches between its instructions, declared requirements, and scripts — you should not install/use it until those issues are resolved.

Purpose & Capability

The code and SKILL.md align with a 'Composio' integration (listing tools, endpoints, and scripts that call backend.composio.dev). However the registry metadata declares no required environment variables or credentials while the runtime instructions and scripts clearly expect a COMPOSIO_API_KEY and a Node runtime. This mismatch (no declared primary credential vs. explicit API key usage) is incoherent and surprising.

Instruction Scope

SKILL.md includes a plaintext API key (ak_AXxQjyexBuSiJXTYOTPB), explicit connected-account IDs and an email address, and points to a local credential file (/home/sidharth/clawd/memory/composio-credentials.md) and a specific ~/.bashrc line. The README therefore exposes sensitive secrets and environment-specific paths. It also gives examples that require exporting COMPOSIO_API_KEY and running Node scripts, which is outside the metadata's declared requirements.

Install Mechanism

There is no install spec (instruction-only), which is lower risk in principle. The package.json lists an npm dependency (@composio/client), so installing npm packages / node is necessary but not declared. The scripts use curl and jq and assume Node is available; required binaries were declared as 'none' in metadata — that mismatch is a usability and coherence problem but not direct evidence of malicious intent.

Credentials

Sensitive credentials are embedded in the SKILL.md rather than declared as required env vars: a clear plaintext COMPOSIO API key, specific connected account IDs, and a user email. The bundle expects COMPOSIO_API_KEY at runtime (scripts reference process.env.COMPOSIO_API_KEY) but the skill metadata didn't ask for it. Hard-coded credentials bundled with a skill are disproportionate and risky (possible leaked or stale key).

Persistence & Privilege

The skill is not marked 'always: true' and does not request to modify other skills or system-wide settings. It does reference user-local paths (which are likely specific to the original developer) but does not itself declare persistence or privileged installation behavior.

What to consider before installing

Do not install or run this skill as-is. It includes a plaintext API key and connected-account details in SKILL.md and relies on environment variables and binaries that the registry metadata does not declare. Before using: (1) Verify the API key ownership — if it's yours rotate it immediately and do not embed keys in the skill; (2) Remove any hard-coded secrets from documentation and code, and require COMPOSIO_API_KEY via secure secret configuration instead; (3) Ensure required runtimes/utilities are declared (Node, curl, jq) and sanitize or remove references to developer-specific file paths; (4) Confirm the endpoints and user IDs are expected and that you trust backend.composio.dev; (5) If you already used the bundled API key or account, rotate credentials and check activity on that Composio account and the listed Gmail account. If you want to proceed after fixes, insist on a version that does not contain embedded credentials and that declares its required environment variables and binaries.

Composio Integration Skill

Access 600+ apps and services through Composio's unified API. Currently connected: Gmail and Google Tasks.

🔑 API Key Location

Saved securely in: /home/sidharth/clawd/memory/composio-credentials.md
Also in: ~/.bashrc (line 135) - auto-loads on terminal start

API Key: ak_AXxQjyexBuSiJXTYOTPB

📦 Connected Accounts

Gmail (ca_0cxayHx2BME1)

• Email: [e-mail]
• Status: ACTIVE ✅
• Capabilities: Read/send emails, manage labels, drafts, contacts

Google Tasks (ca_kSNnWG4OHngG)

• Email: [e-mail]
• Status: ACTIVE ✅
• Capabilities: Create/update/delete tasks and task lists

🛠️ Available Tools

Gmail Tools (20+)

• GMAIL_FETCH_EMAILS - Fetch emails
• GMAIL_SEND_EMAIL - Send emails
• GMAIL_CREATE_EMAIL_DRAFT - Create draft
• GMAIL_REPLY_TO_THREAD - Reply to email
• GMAIL_SEARCH_EMAILS - Search inbox
• GMAIL_ADD_LABEL_TO_EMAIL - Manage labels
• GMAIL_DELETE_MESSAGE - Delete emails
• And 13+ more...

Google Tasks Tools (17)

• GOOGLETASKS_INSERT_TASK - Create task
• GOOGLETASKS_LIST_TASKS - List tasks
• GOOGLETASKS_LIST_ALL_TASKS - List all tasks across all lists
• GOOGLETASKS_UPDATE_TASK - Update task
• GOOGLETASKS_DELETE_TASK - Delete task
• GOOGLETASKS_CREATE_TASK_LIST - Create task list
• GOOGLETASKS_BULK_INSERT_TASKS - Bulk create tasks
• And 10+ more...

📝 Usage Examples

List Available Tools

export COMPOSIO_API_KEY="ak_AXxQjyexBuSiJXTYOTPB"
node scripts/list-tools.mjs gmail        # Gmail tools only
node scripts/list-tools.mjs googletasks  # Google Tasks tools
node scripts/list-tools.mjs              # All tools (paginated)

Execute a Tool

Fetch Gmail Emails:

node scripts/execute-tool.mjs GMAIL_FETCH_EMAILS ca_0cxayHx2BME1 '{"maxResults":5}'

Create Google Task:

node scripts/execute-tool.mjs GOOGLETASKS_INSERT_TASK ca_kSNnWG4OHngG '{"title":"My Task","notes":"Task details"}'

Send Email:

node scripts/execute-tool.mjs GMAIL_SEND_EMAIL ca_0cxayHx2BME1 '{"to":"[e-mail]","subject":"Hello","body":"Hi there!"}'

🔧 Implementation Details

Base URL (v3 API)

https://backend.composio.dev/api/v3/

Authentication

All requests use header:

x-api-key: ak_AXxQjyexBuSiJXTYOTPB

User ID

All tool executions use:

user_id: pg-test-228260f1-217f-40f6-a08a-41fdd0b8d8e6

Scripts Location

/home/sidharth/clawd/skills/composio-integration/scripts/
├── list-tools.mjs       # List available tools
├── execute-tool.mjs     # Execute any tool
└── (future scripts)

🎯 Common Use Cases

Morning Email Summary

node scripts/execute-tool.mjs GMAIL_FETCH_EMAILS ca_0cxayHx2BME1 '{"maxResults":10,"labelIds":["INBOX"]}'

Add Task from Email

1. Fetch email
2. Extract key info
3. Create task:

node scripts/execute-tool.mjs GOOGLETASKS_INSERT_TASK ca_kSNnWG4OHngG '{"title":"Follow up: Email subject","notes":"From: [e-mail]"}'

Send Follow-up Email

node scripts/execute-tool.mjs GMAIL_SEND_EMAIL ca_0cxayHx2BME1 '{
  "to":"[e-mail]",
  "subject":"Re: Your inquiry",
  "body":"Thank you for reaching out..."
}'

🔄 Adding New Apps

To connect more apps (Calendar, Notion, Slack, etc.):

1. Visit: https://app.composio.dev/apps
2. Click "Connect" on desired app
3. Complete OAuth flow
4. Note the connected_account_id
5. Use with execute-tool.mjs

📚 API Reference

Full v3 API Docs: https://docs.composio.dev/rest-api/

Key Endpoints Used:

• GET /api/v3/tools - List tools
• GET /api/v3/tools/:slug - Get tool schema
• POST /api/v3/tools/execute/:slug - Execute tool
• GET /api/v3/connected_accounts - List connections

✅ Tested & Working

• ✅ API key authentication
• ✅ Gmail email fetching
• ✅ Tool discovery (600+ apps)
• ✅ Connected account management
• ✅ v3 API compliance (no deprecated endpoints)

🚀 Next Steps

• Create wrapper functions for common tasks
• Add Google Calendar integration
• Build email-to-task automation
• Create morning digest generator
• Add error handling & retry logic

---

Last Updated: 2026-01-20
Status: ✅ Fully Operational
Integration Time: ~30 minutes