composio-mcp
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a
COMPOSIO_REMOTE_BASH_TOOLwhich permits the execution of shell commands such as jq, awk, sed, and grep in a remote sandbox environment provided by the vendor. - [REMOTE_CODE_EXECUTION]: The
COMPOSIO_REMOTE_WORKBENCHtool allows for the execution of Python scripts and the orchestration of multi-tool chains within a persistent remote Jupyter notebook. - [PROMPT_INJECTION]: The skill facilitates the processing of data from a large number of external services, which introduces a surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through tool outputs when fetching content from external apps like Gmail, Slack, or GitHub (referenced in SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters defined to isolate or sanitize instructions that may be embedded within the retrieved data.
- Capability inventory: The skill provides high-privilege capabilities including remote shell execution, Python scripting, and the ability to trigger actions across 1000+ integrated services (referenced in SKILL.md).
- Sanitization: The documentation does not specify any sanitization or validation steps for the content ingested from external connectors.
Audit Metadata