Security audit

Connect Apps

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly meant to connect Claude to apps and perform real actions, but it asks users to install and authorize a broad third-party tool without enough scoping or verification detail.

Install only if you trust the `composio-toolrouter` plugin source and are comfortable granting it access to connected apps. Use narrow OAuth scopes where available, confirm each live action before execution, and know how to revoke the API key and app authorizations if needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:12
Finding: Unpinned Privileged Third-Party Plugin Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The metadata description is broad enough to match many ordinary requests involving Gmail, Slack, GitHub, or other external services, which can cause the skill to activate in situations where the user may only want advice or drafted content. Because this skill is explicitly designed to perform real actions in third-party systems, overbroad invocation increases the chance of unintended side effects such as sending messages or modifying external resources.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The text emphasizes that the skill will 'actually send emails, create issues, post messages' but does not clearly separate generating content from performing real-world actions. In a tool-routing environment, that ambiguity can lead users or upstream agents to invoke the skill when only a draft was intended, resulting in unintended communications or changes across connected services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill lacks a prominent warning that actions have real side effects across connected apps, despite supporting email, chat, issue trackers, docs, and databases. Without a clear warning, users may not appreciate that normal-looking requests can trigger live operations, increasing the risk of accidental data modification, information disclosure, or unauthorized communications.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.