composio

Savant verdict: Unsafe

Savant's security policy blocks importing this skill.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Security assessment

18 patterns found

• Supply Chain: curl -fsSL https://composio.dev/install | bashhigh · AGENTS.md:49 · Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
• Supply Chain: curl -fsSL https://composio.dev/install | bashhigh · SKILL.md:18 · Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
• Supply Chain: curl -fsSL https://composio.dev/install | bashhigh · rules/composio-cli.md:18 · Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
• Tool Misuse: | bashhigh · AGENTS.md:49 · Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
• Tool Misuse: | bashhigh · SKILL.md:18 · Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
• Tool Misuse: | bashhigh · rules/composio-cli.md:18 · Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
• Privilege Escalation: .envhigh · rules/setup-api-keys.md:108 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .envhigh · rules/setup-api-keys.md:161 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .env.localhigh · rules/setup-api-keys.md:162 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Data Exfiltration: Log sessionhigh · rules/tr-session-lifecycle.md:314 · Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Structure

• No license declaredConfirm you may reuse this skill before importing it into your repository.
• The source hub's security checks flagged this skillGen Agent Trust Hub: fail (Error: AI Analysis failed with no response - please submit the skill again); Snyk: fail (Risk: CRITICAL · 3 issues)

SKILL.md

---
name: composio
description: Use 1000+ external apps via Composio - either directly through the CLI or by building AI agents and apps with the SDK
tags: [composio, tool-router, agents, mcp, tools, api, automation, cli]
---

## When to Apply

- User wants to access or interact with external apps (Gmail, Slack, GitHub, Notion, etc.)
- User wants to automate a task using an external service (send email, create issue, post message)
- Building an AI agent or app that integrates with external tools
- Multi-user apps that need per-user connections to external services

## Setup

Check if the CLI is installed; if not, install it:
```bash
curl -fsSL https://composio.dev/install | bash
```

After installation, restart your terminal or source your shell config, then authenticate:
```bash
composio login       # OAuth; interactive org/project picker (use -y to skip)
composio whoami      # verify org_id, project_id, user_id
```
For agents without direct browser access: `composio login --no-wait | jq` to get URL/key, share URL with user, then `composio login --key <cli_key> --no-wait` once they complete login.

---

### 1. Use Apps via Composio CLI

**Use this when:** The user wants to take action on an external app directly — no code writing needed. The agent uses the CLI to search, connect, and execute tools on behalf of the user.

Key commands (new top-level aliases):
- `composio search "<query>"` — find tools by use case
- `composio execute "<TOOL_SLUG>" -d '{...<input params>}'` — execute a tool
- `composio link [toolkit]` — connect a user account to an app (agents: always use `--no-wait` for non-interactive mode)
- `composio listen` — listen for real-time trigger events

Typical workflow: **search → link (if needed) → execute**

> Full reference: [Composio CLI Guide](rules/composio-cli.md)

---

### 2. Building Apps and Agents with Composio

**Use this when:** Writing code — an AI agent, app, or backend service that integrates with external tools via the Composio SDK.

Run this first inside the project directory to set up the API key:
```bash
composio init
```

> Full reference: [Building with Composio](rules/building-with-composio.md)