The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Instructions in SKILL.md and AGENTS.md recommend installing the Composio CLI using curl -fsSL https://composio.dev/install | bash. This pattern is a high-risk security practice as it executes unverified code from a remote server with the permissions of the current shell session.
[PROMPT_INJECTION]: The skill integrates with over 1,000 external applications (e.g., Gmail, Slack, GitHub, Notion), which acts as a massive ingestion point for untrusted data. This creates a significant surface for indirect prompt injection attacks, as malicious instructions within processed data (like emails or chat messages) could influence agent behavior.
Ingestion points: 1,000+ external apps including Gmail, Slack, and GitHub (referenced in SKILL.md and AGENTS.md).
Boundary markers: The instructions lack explicit boundary markers or guidelines for the agent to ignore instructions embedded within the processed external data.
Capability inventory: Significant system and account access capabilities including composio execute, composio link, and event listening across multiple rule files (e.g., rules/app-execute-tools.md, rules/triggers-create.md).
Sanitization: No sanitization or escaping protocols are defined for handling untrusted content from external APIs before it enters the agent context.

composio