composio cli

Use 1000+ external apps via Composio - either directly through the CLI or by building AI agents and apps with the SDK

This skill appears to be documentation for a real CLI/SDK (Composio) and could be useful if you trust the vendor, but there are several red flags to consider before installing or letting an agent act on it: - Do NOT run curl -fsSL https://composio.dev/install | bash without verification. Download-and-execute from a URL can run arbitrary code on your machine. Prefer an official package (brew/apt/pnpm/pip) or verify the installer via checksums/GPG signatures or an official GitHub release. - The registry metadata says no env vars are required, but the docs show examples using COMPOSIO_API_KEY. Expect to need an API key for SDK usage — only provide keys with least privilege and never paste secrets into untrusted shells or chat logs. - The SKILL.md includes CLI commands that perform OAuth linking and tool execution. If you allow the agent to call these autonomously, it could act on your connected apps (send email, create issues, post messages). Consider disabling autonomous model invocation for this skill or audit every invocation policy if you don't want fully autonomous actions. - A prompt-injection pattern was detected in the skill text. Review the SKILL.md manually for any instructions that attempt to override agent/system prompts or to exfiltrate data (e.g., by recommending to pipe outputs to remote endpoints). Remove or sandbox any such steps. - If you need to try this: test in an isolated environment (VM/container) and with a disposable Composio account or limited-scope credentials. Inspect the install script before running it and verify the composio.dev domain and repository provenance (GitHub repo, official docs, company site, package signatures). If you want, I can: (a) extract and display the exact install script content from the URL (if you fetch it) so you can inspect it, (b) highlight the lines in SKILL.md that reference secrets or the API key, or (c) suggest safer install/verification steps and a minimal permission strategy for OAuth/API keys.

Type: OpenClaw Skill Name: composiocli Version: 1.0.0 The bundle provides comprehensive documentation and instructions for an AI agent to interact with the Composio platform via its CLI and SDK. It includes standard installation procedures (curl | bash from composio.dev) and detailed guides on authentication, session management, and tool execution. The instructions and 'rules' files (e.g., rules/setup-api-keys.md and rules/app-user-context.md) explicitly promote security best practices, such as avoiding hardcoded API keys and maintaining user data isolation. No evidence of malicious intent, data exfiltration, or unauthorized persistence was found.