ClawHub
Back to skill

Security audit

App Connectors

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Composio connector guide, but it gives broad authority to connect and act in third-party apps without clearly requiring user confirmation for side-effecting actions.

Install only if you are comfortable granting an agent Composio-mediated access to connected apps. Configure a project-scoped COMPOSIO_API_KEY, avoid letting the agent search unrelated secret stores, and require explicit approval before sends, writes, deletes, disconnects, or bulk actions in external services.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Content
**Required:**
- `COMPOSIO_API_KEY` — Project-scoped API key from Composio

If not in env, check the framework's secrets provider (vault, secrets.json, .env). If missing, stop and report to the operator.

## API Reference
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to look for secrets in generic local secret stores such as secrets.json and .env. In an agent environment, this expands behavior from using pre-scoped credentials to actively searching for secrets, which can normalize credential access patterns and increase the chance of unauthorized secret retrieval or disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
Use the v1 REST API to get all active connections for the current entity:

```bash
curl -s "https://backend.composio.dev/api/v1/connectedAccounts?user_uuid=default&showActiveOnly=true" \
  -H "x-api-key: $COMPOSIO_API_KEY"
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to execute actions on third-party apps after tool discovery and connection checks, but it does not require a user-facing warning or confirmation before performing potentially side-effecting operations. This increases the risk of the agent sending emails, modifying records, or taking external actions without sufficiently explicit user consent or awareness.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger model is overly broad: the table says that when a user says an app name or 'Connect Slack', the agent should invoke connection-management behavior. In a conversational agent, this can cause unintended OAuth initiation or connector changes from ambiguous user text, especially if the agent does not explicitly confirm intent before starting a connection flow.

Static analysis

No suspicious patterns detected.