The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in SKILL.md and rules/composio-cli.md explicitly directs users to run curl -fsSL https://composio.dev/install | bash. This pattern downloads a remote script and executes it directly, posing a severe risk of arbitrary code execution if the domain or transport is compromised.
[COMMAND_EXECUTION]: The skill empowers the agent to use the composio CLI to perform actions across hundreds of applications. Tools such as composio execute allow for dynamic interaction with external APIs, which can be misused if the agent processes malicious instructions.
[DATA_EXFILTRATION]: The skill enables an agent to read sensitive data from platforms like Gmail, Slack, and GitHub. This capability presents a high risk for data exfiltration if the agent is instructed to move private information between tools or to unauthorized external endpoints.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Ingestion points include email triggers and message events (e.g., GMAIL_NEW_GMAIL_MESSAGE in rules/triggers-create.md). The capability inventory spans command execution via the CLI and network operations through the SDK. The skill lacks boundary markers or sanitization to prevent an agent from executing malicious commands embedded in these external data sources.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of numerous external dependencies from NPM, PyPI, and the composio.dev domain, which increases the supply chain attack surface for the environment.

composio