Is composio-community/skills safe?
https://github.com/composio-community/skills
The composio-community/skills repository is a legitimate developer-focused SDK integration guide for the Composio platform, but presents several meaningful security concerns. Most significantly, the SKILL.md instructs agents to execute a curl-pipe-bash installation command without verification, and the skill's design grants unrestricted agent authority to execute actions across all user-connected external accounts (Gmail, Slack, GitHub, etc.) with no per-action confirmation gate — making it a high-value target for exfiltration via prompt injection. The clone itself was behaviorally clean with only expected GitHub network traffic, and the canary file accesses recorded in the audit log are attributable to the monitoring framework's baseline hashing (pre-clone timing, read-only access, and 'canary intact' verdict all confirm this).
Category Scores
Findings (9)
HIGH curl-pipe-bash installation in SKILL.md -30 ▶
The primary SKILL.md instructs the agent to execute curl -fsSL https://composio.dev/install | bash as the first setup step. This pattern downloads and immediately executes untrusted code from the internet with the user's shell privileges. A compromised composio.dev CDN, BGP hijack, or MITM attack would result in arbitrary code execution on the user's machine without any verification.
HIGH Indirect exfiltration via Composio tool execution -25 ▶
The skill enables the agent to execute any of 1000+ external service tools on behalf of the user with no per-action confirmation. A prompt-injected agent could call GMAIL_SEND_EMAIL with sensitive file contents, SLACK_SEND_MESSAGE to an attacker's workspace, or any other tool to exfiltrate data through a legitimate authenticated channel that bypasses network-level filtering.
HIGH Unrestricted agent authority over all connected accounts -30 ▶
The skill grants the agent full authority to perform actions across any service the user has connected to Composio (Gmail, Slack, GitHub, Linear, Notion, etc.) with no per-action approval requirement. The skill explicitly recommends manageConnections: true which causes the agent to silently handle authentication, further reducing user visibility into what actions are being taken.
MEDIUM Honeypot credential files accessed during audit window -15 ▶
Six honeypot files were opened and read during the audit: .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json. Timing analysis (accesses at 17:49:32, before the 17:49:37 git clone) and the 'canary intact' verdict indicate these were likely accessed by the audit infrastructure's baseline hashing process rather than the skill itself, but the access events are recorded in the audit trail and cannot be definitively attributed.
MEDIUM Executable Python scripts with broad file system operations -15 ▶
Three Python scripts are present with execute permissions (0100775): quick_validate.py, init_skill.py, and package_skill.py. The skill-creator SKILL.md explicitly instructs the agent to run init_skill.py and package_skill.py as part of skill creation workflows. These scripts perform file system operations (creating directories, writing files) and could be abused.
MEDIUM Persistent OAuth credentials with indefinite validity -20 ▶
The skill's setup flow creates persistent OAuth credentials via composio login that are stored on disk indefinitely. These credentials authenticate to the Composio platform and enable tool execution against all connected accounts. Any process on the user's machine that can read the credential store (including future malicious software) can exploit these permissions.
LOW Extremely broad skill trigger scope -10 ▶
The skill's description triggers on any request to interact with external apps (Gmail, Slack, GitHub, Notion, etc.) or automate tasks using external services. This causes the skill to activate in a very wide range of scenarios, injecting ~150KB of Composio-specific instructions into the agent's context, potentially crowding out other safety considerations.
LOW Repository symlink crossing directory boundaries -5 ▶
A symlink exists at .claude/skills/skill-creator pointing to ../../.agents/skills/skill-creator. While this resolves within the repository root, the double-parent traversal pattern warrants inspection in environments where symlink following policies may be inconsistently applied.
INFO Build scripts present without auto-execution hooks -5 ▶
package.json contains build:agents and watch:agents npm scripts but no preinstall, postinstall, or prepare hooks. No git hooks found. Scripts execute only on explicit npm run invocation.