connect-apps
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install an external plugin using the
/plugin install composio-toolroutercommand. This downloads and integrates third-party code from the Composio platform to handle tool routing and service connections. - [COMMAND_EXECUTION]: The setup process requires the execution of slash commands, specifically
/plugin install composio-toolrouterand/composio-toolrouter:setup, to configure the environment and handle API authentication. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to act on data from external applications, which introduces a vulnerability to indirect prompt injection.
- Ingestion points: The agent processes content from external apps like Gmail, Slack, and GitHub (e.g., reading emails or issue descriptions) based on user requests in
SKILL.md. - Boundary markers: The provided instructions do not include specific boundary markers or 'ignore embedded instructions' warnings for processing external data.
- Capability inventory: The skill possesses high-impact capabilities including sending emails, creating GitHub issues, and posting to Slack or Notion as detailed in
SKILL.md. - Sanitization: There is no evidence of input sanitization or validation routines to filter malicious instructions within the data being processed.
Audit Metadata