composio-mcp
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes the
COMPOSIO_REMOTE_BASH_TOOL, which permits running shell commands such as jq, awk, or grep in a remote sandbox to manipulate data retrieved from external services. This is a documented feature for handling large tool responses.\n- [REMOTE_CODE_EXECUTION]: The skill providesCOMPOSIO_REMOTE_WORKBENCH, which is a remote Python/Jupyter sandbox environment used for bulk processing and scripting across multiple tools. This environment includes helper functions likerun_composio_toolfor orchestrated workflows.\n- [DATA_EXFILTRATION]: The skill is designed to move data between external services and remote processing sandboxes; this is an intended feature of the Composio orchestration platform and uses OAuth for managed authentication.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes untrusted data from external services like Slack or GitHub and possesses high-privilege capabilities.\n - Ingestion points: Data enters the agent context from 1000+ external services via tool calls as described in
SKILL.md.\n - Boundary markers: No specific delimiters or instructions to ignore embedded instructions are defined in the instructions.\n
- Capability inventory: Includes remote shell access (
COMPOSIO_REMOTE_BASH_TOOL), Python execution (COMPOSIO_REMOTE_WORKBENCH), and multi-tool execution (COMPOSIO_MULTI_EXECUTE_TOOL).\n - Sanitization: No sanitization or escaping of external content is described in the prompt-based workflow.
Audit Metadata