composio-artifacts
Warn
Audited by Snyk on Jun 25, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.65). The required workflow is installing/invoking the
composio-artifactsskill from the upstream GitHub repo (public web content) vianpx skills add ... ComposioHQ/awesome-claude-skills --skill composio-artifacts, and the installed skill’s runtime may ingest outsider-authored free text from that fetched repository content into the agent’s LLM context.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill stub instructs running "npx skills add ComposioHQ/awesome-claude-skills --skill composio-artifacts" which fetches and installs remote code from https://github.com/ComposioHQ/awesome-claude-skills at runtime and that fetched skill repository will provide the skill logic/prompts and enable execution of integrations, so this is a runtime external dependency that can control prompts/execute code.
Issues (2)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata