App Connectors

What to consider before installing: - The runtime docs require COMPOSIO_API_KEY, but the registry metadata did NOT declare any required env vars — ask the publisher to update metadata to explicitly require COMPOSIO_API_KEY before trusting the skill. - The skill's API calls go to https://backend.composio.dev; verify that this domain and the Composio service are legitimate for your organization and that you trust the operator who will receive OAuth redirect completions. - The SKILL.md suggests checking generic secret stores (vault, .env, secrets.json). Confirm how your agent/framework restricts secret access; do NOT give the agent blanket access to your vault or all secrets — restrict it to a specific project-scoped Composio key if possible. - Because this is instruction-only, there is no installer risk, but the key itself will authorize the agent to manage OAuth connections and execute actions. Limit the key's scope and lifespan (use project-scoped keys, rotate/revoke when not needed). - If you need higher confidence: request an official homepage or publisher contact, a documented privacy/security policy for Composio, and an updated registry entry that declares the COMPOSIO_API_KEY requirement and the exact scopes/permissions the key grants. Confidence is medium because the skill's behavior is coherent for a connector, but the metadata omission and the broad guidance to search secret stores create a non-trivial risk.