Google Contacts Search

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.1

Overview

This is a narrow Google Contacts search skill, but users should understand it relies on a Composio API key and an external `gog` tool to access contact data.

Before installing, confirm you trust the `gog` binary and the Composio account connection it uses. Grant only the Google Contacts access needed for search, keep `COMPOSIO_API_KEY` secret, and monitor or stop the workflow if retries continue after failures.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill manifest requires a sensitive credential (COMPOSIO_API_KEY) but the visible skill description and body do not clearly disclose that the skill will use an external account-linked API or explain the security/privacy implications. This creates a real transparency and consent problem: users may authorize or run the skill without understanding that contact data access depends on a sensitive secret and may involve third-party handling of personal address-book information.

VirusTotal

65/65 vendors flagged this skill as clean.