composio-mcp

Warn

Audited by Snyk on Apr 25, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

  • Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to connect to and fetch/execute actions against 1000+ external apps (e.g., "GitHub, Slack, Notion, Gmail" and examples like "fetch Gmail emails" and "Include inline references/links (e.g., Slack thread links, GitHub PR URLs) in results"), so the agent will ingest and act on user-generated/untrusted third-party content that can influence subsequent tool use and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

  • Potentially malicious external URL detected (high risk: 0.80). The skill depends at runtime on the Composio MCP endpoint (connect.composio.dev/mcp), which exposes COMPOSIO_REMOTE_BASH_TOOL and COMPOSIO_REMOTE_WORKBENCH that execute shell/Python code in a remote sandbox, so external content can cause remote code execution.

Issues (2)

W011
MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

W012
MEDIUM

Unverifiable external dependency detected (runtime URL that controls agent).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 25, 2026, 01:00 AM
Issues
2