composio

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows and instructs use of a CLI flag that embeds a CLI/API key (composio login --key <cli_key>) and directs sharing/placing that key in commands, which requires the LLM to handle and potentially output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly guides agents to connect to and fetch content from external user-generated services (e.g., Gmail, Slack, GitHub, Notion) via the Composio CLI/SDK (see "Primary Workflow: search → link → execute" and the Composio CLI Guide examples like composio execute GMAIL_SEND_EMAIL and SDK flows such as session.tools() / tools.get() used in tr-building-chat-ui), so untrusted third-party content is read and used to drive agent decisions and tool execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs installing a CLI at runtime via "curl -fsSL https://composio.dev/install | bash", which fetches and executes remote code that the skill relies on for CLI-driven operations, creating a high-risk remote code execution dependency (https://composio.dev/install).