composio
Warn
Audited by Snyk on Feb 17, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill documents Tool Router and Direct Execution flows that let agents access user-connected third-party services (e.g., Gmail, Slack, GitHub) — see examples like "Fetch my last email" and APIs such as session.tools(), composio.tools.execute(), and manageConnections/session.authorize() which cause the agent to fetch and read user-generated content from those external services.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The skill uses runtime MCP server URLs (e.g., session.mcp.url such as https://mcp.composio.dev/session/your_session_id) which are fetched at runtime by MCP clients to load tool definitions/endpoints that agent frameworks incorporate and invoke, so the external content directly controls agent tools/execution.
Audit Metadata