composio-automation
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to fetch and adhere to dynamic execution plans and tool schemas from the Rube MCP server (rube.app). This creates an attack surface where a compromised or malicious server could provide instructions that override or influence the agent's behavior.
- Ingestion points: Results from RUBE_SEARCH_TOOLS (SKILL.md).
- Boundary markers: Not specified in the instructions.
- Capability inventory: Execution of discovered tools via RUBE_MULTI_EXECUTE_TOOL and RUBE_REMOTE_WORKBENCH (SKILL.md).
- Sanitization: Not specified.
- [DATA_EXFILTRATION]: The skill documentation directs the user to configure a connection to an external MCP server at https://rube.app/mcp. This establishes a network communication path to a domain outside the standard whitelisted services. This endpoint is identified as part of the author's (composiohq) infrastructure for providing the Rube MCP service.
Audit Metadata