connect-apps
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation procedure using
curl -fsSL https://composio.dev/install | bash. This pattern downloads and executes a script directly from the vendor's official website to set up the CLI environment. - [COMMAND_EXECUTION]: The skill relies on the
composioCLI to perform actions, search for tools, and run workflows. Specifically, thecomposio runandcomposio proxycommands allow for dynamic execution of logic and raw API interactions, which are core features of the tool. - [EXTERNAL_DOWNLOADS]: The skill downloads the CLI installation package from the vendor's infrastructure at
https://composio.dev. - [PROMPT_INJECTION]: The skill is designed to ingest and process data from external applications, which creates a surface for indirect prompt injection.
- Ingestion points: Data retrieved from external apps via
composio execute(e.g., email bodies from Gmail, issue descriptions from GitHub). - Boundary markers: No specific delimiters or "ignore instructions" markers are provided for handling retrieved data.
- Capability inventory: The skill has the ability to execute CLI commands and make network requests via the Composio toolset.
- Sanitization: There is no evidence of sanitization or filtering applied to data retrieved from external tools before it is processed by the agent.
Audit Metadata