apilio-automation
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- REMOTE_CODE_EXECUTION (HIGH): The skill requires the addition of an unverified MCP server at
https://rube.app/mcp. This server provides the tools and execution logic (RUBE_MULTI_EXECUTE_TOOL) that the agent runs. Since the source is not in the trusted repository list, this constitutes a risk of executing unverified remote code. - PROMPT_INJECTION (HIGH): The skill is highly vulnerable to Indirect Prompt Injection (Category 8).
- Ingestion points:
RUBE_SEARCH_TOOLSreturns tool schemas, input definitions, and 'recommended execution plans' from the remote server. - Boundary markers: None are present to distinguish between benign tool schemas and malicious instructions embedded in the search results.
- Capability inventory: The agent can execute arbitrary tools via
RUBE_MULTI_EXECUTE_TOOLandRUBE_REMOTE_WORKBENCH, and manage account connections viaRUBE_MANAGE_CONNECTIONS. - Sanitization: The skill lacks any mechanism to sanitize the data returned by the search tools before it is used to structure following tool calls.
- COMMAND_EXECUTION (MEDIUM): The use of
RUBE_REMOTE_WORKBENCHandrun_composio_tool()indicates that the agent is designed to trigger commands or scripts on a remote environment provided by the service, which may have side effects on the connected Apilio infrastructure.
Recommendations
- AI detected serious security threats
Audit Metadata