Security audit

MakeX

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documented integration proxy that can execute live actions on connected third-party accounts, but some mutating behavior is too broadly scoped and under-disclosed.

Install or enable this only for trusted server-side callers. Protect the org token like a production secret, restrict which Composio actions and connected accounts may be used, require explicit user confirmation before sending messages or modifying external systems, and avoid using output-structure on actions that can cause side effects.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents a `run-action` endpoint that can send emails, messages, or perform other third-party actions, but it does not warn that invoking it can cause real side effects in external systems. In an agent setting, this omission increases the risk of unintended execution, unauthorized data modification, or outbound actions being triggered from prompt context without explicit user awareness or confirmation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `output-structure` endpoint is described as a way to inspect response shape, but the text says it executes the action to obtain that structure. Without a prominent warning, users or agents may assume this is safe/introspective and accidentally trigger real-world effects such as sending emails or changing external resources.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The endpoint description indicates that a valid org token can be used to enumerate whether specific integrations are connected and, on 404, reveals other available integrations for the organization. It also returns connected account identifiers and org-linked details, which can expose internal integration inventory and metadata useful for reconnaissance if the org token is leaked or overly broadly accessible.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The endpoint forwards account-linked identifiers and caller-supplied arguments to an external third-party API, but the documentation provides no warning, consent model, or data minimization guidance for that transfer. In a skill ecosystem, this increases the risk of unintentional disclosure of sensitive user or tenant data to an external processor, especially if callers assume the operation is internal-only.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The endpoint allows callers with an org service token to execute any Composio tool action slug against any specified connected account, with no documented allowlist, per-tool authorization, or account-to-org ownership validation. This creates a broad proxy to third-party capabilities, so a compromised or overissued org token could be used to invoke sensitive actions such as sending mail, reading data, or mutating external systems far beyond an intended minimal scope.

Vague Triggers

Low

Confidence: 78% confidence
Finding: This is a plain-text file, so vague-trigger review applies. The purpose statement says only that it is 'useful for determining the shape of an action's response data,' but it does not provide specific invocation conditions, exclusions, or negative examples, which could lead to overly broad use of the skill.

Natural-Language Policy Violations

Low

Confidence: 51% confidence
Finding: The file states that the raw Composio response is returned directly, but it does not document any user language or locale selection if those responses are shown downstream. This is only a weak policy concern, but direct passthrough of natural-language output can violate language/locale requirements when no opt-in or documented constraint exists.

Static analysis

No suspicious patterns detected.