connect-apps
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the command
/plugin install composio-toolrouterto extend functionality. The plugin is provided by a well-known service focused on AI tool integrations. - [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by enabling the agent to ingest and act upon data from external applications (e.g., Gmail, Slack, GitHub).
- Ingestion points: The agent reads data from connected apps, including email content, chat messages, and task descriptions.
- Boundary markers: The instructions do not define specific delimiters or instructions to prevent the agent from following commands embedded within the external data.
- Capability inventory: The skill enables high-impact actions including sending emails, posting messages, and creating issues across a wide range of services.
- Sanitization: No explicit sanitization or filtering of incoming data is mentioned in the skill instructions.
Audit Metadata