The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external sources, including Composio API responses (e.g., via GET /connected_accounts) and task metadata, which is then used as input for subsequent CLI commands and tool executions. This creates a surface where malformed or malicious data from connected third-party accounts could influence the agent's actions.
Ingestion points: Data returned by resolve-user (SKILL.md) and GET /connected_accounts (SKILL.md).
Boundary markers: The instructions do not define explicit delimiters or instructions for the agent to disregard commands potentially embedded within the content of retrieved emails, docs, or account metadata.
Capability inventory: The agent can execute a wide range of Composio REST API methods via the CLI and modify platform-level user profiles using the manage-user capability.
Sanitization: No explicit logic is provided to validate or escape external IDs or API results before they are interpolated into new command structures.
[COMMAND_EXECUTION]: The skill's primary interface is a CLI wrapper (agent-swarm x composio). The agent is instructed to construct and execute shell-level commands with dynamic arguments derived from the conversation and external API calls.
[PRIVILEGE_ESCALATION]: The skill documents the use of the manage-user utility to update user identities and map them to external services. This is a sensitive administrative function that allows the agent to modify user account configurations, which could lead to unauthorized access or data corruption if mismanaged.

composio