Google Drive (Composio)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:52 AM UTC
• Version: 1.0.0

Overview

This Google Drive skill is purpose-aligned but needs Review because it can mutate and share Drive files while using under-contained local file writes and a disabled remote tool version safety check.

Install only if you trust the Composio connection and the agent environment. Use a Drive account with limited access, confirm every share, move, trash, overwrite, and upload action, avoid broad shared-drive permissions, and prefer running it in a workspace where local file overwrites cannot affect important files. Pin the composio dependency and remove the remote tool version-check bypass before broad or unattended use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Composio Dependency Creates Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–25
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Relevant Code:

yaml

"requires": { "python": ["composio"] },

bash

pip install composio

Technical Analysis

The Skill installs the composio package without specifying a reviewed version or package-integrity hash. Consequently, installation can resolve to any current release available from the configured Python package repository.

The package is imported directly by google_drive_api.py and is initialized with the COMPOSIO_API_KEY. It also processes the account identifier, Google Drive operation arguments, file metadata, and selected file contents. A compromised or unexpectedly modified dependency release would therefore execute with the same local privileges as the Skill and have access to sensitive runtime information.

No evidence indicates that the current composio package is malicious. The vulnerability is the absence of dependency controls that would prevent an unreviewed future package version from being installed.

Attack Path

1. An attacker compromises a future composio release or the package-distribution channel.
2. The Skill environment runs pip install composio or resolves the dependency from the unpinned metadata.
3. The compromised package executes during installation or when imported.
4. The package reads the Composio API key and account identifier from the process environment.
5. During normal use, it can inspect Drive requests, selected upload content, and returned Drive data.
6. The malicious package can exfiltrate those values or alter requested Drive operations.

Impact Assessment

Successful exploitation would provide code execution with the privileges of the process running the Skill. It could expose the Composio API key, account identifier, selected local upload data, and Google Drive information available th ...[truncated 122 chars]

Remediation

View remediation

Remediation Suggestions

• Pin composio to a specific reviewed version in both the Skill metadata and installation instructions.
• Use a lockfile or constraints file with cryptographic package hashes.
• Install packages with hash verification, such as pip install --require-hashes.
• Review release notes and security changes before updating the pinned version.
• Use a trusted, authenticated package repository or controlled internal mirror.
• Run the Skill in a restricted environment with only the filesystem and network access required for its declared functionality.

T09 · Insecure Skill Coding Practices

Warning

• Location: google_drive_api.py:46

Finding

Composio Tool-Version Safety Validation Is Explicitly Disabled

Content

View full analysis

Vulnerability Details

File Location: google_drive_api.py, lines 46–52
Vulnerability Type: Unsafe remote tool configuration
Risk Level: Medium

Relevant Code:

python

result = _client().tools.execute(
    slug=slug,
    arguments=arguments,
    user_id=_user_id(),
    dangerously_skip_version_check=True,
)

Technical Analysis

Every Composio tool invocation sets dangerously_skip_version_check=True. This explicitly bypasses the SDK's tool-version compatibility protection.

The bypass applies not only to read-only operations but also to security-sensitive and destructive operations, including file uploads, moves, trashing, metadata changes, and permission creation. If the remote tool schema or semantics change, the client may continue sending arguments without detecting incompatibility. Arguments could then be ignored, reinterpreted, or applied with behavior that differs from the reviewed implementation.

This setting does not independently prove that Composio will behave maliciously. It removes a defensive boundary intended to detect unexpected remote tool changes.

Attack Path

1. A Composio Google Drive tool version or schema changes after the Skill is reviewed.
2. The local Skill continues invoking the tool by slug with the previous argument structure.
3. Version compatibility checking is bypassed because dangerously_skip_version_check is enabled.
4. A mutating command such as share, move, trash, or create-file is submitted.
5. The changed remote tool interprets the old arguments differently or applies new default behavior.
6. The connected Drive account experiences an unintended disclosure or file modification.

Impact Assessment

The impact is bounded by the permissions of the connected Google account and Composio integration. Potential consequences include unintended file sharing, moving or trashing files, uploading content to an incorrect destination, or rec ...[truncated 172 chars]

Remediation

View remediation

Remediation Suggestions

• Remove dangerously_skip_version_check=True and retain the SDK's normal compatibility validation.
• Pin and explicitly approve Composio tool versions where supported.
• Fail closed when the SDK reports a schema or version mismatch.
• Validate the expected argument schema and response structure locally.
• Apply stricter validation to mutating commands such as share, trash, move, and update-file.
• Require explicit user confirmation immediately before destructive operations or permission changes.
• Add integration tests against the approved remote tool versions before upgrades.

T09 · Insecure Skill Coding Practices

Warning

• Location: google_drive_api.py:75

Finding

Unrestricted Remote File Retrieval and Caller-Controlled Local File Overwrite

Content

View full analysis

Vulnerability Details

File Location: google_drive_api.py, lines 75–108
Vulnerability Type: Unvalidated remote URL and unsafe output path handling
Risk Level: Medium

Relevant Code:

python

def _find_file_ref(payload: object, _depth: int = 0) -> str | None:
    """Walk a Composio response looking for a local path or download URL."""
    if _depth > 4:
        return None
    if isinstance(payload, str):
        if payload.startswith(("http://", "https://")) or os.path.exists(payload):
            return payload
        return None
    if isinstance(payload, dict):
        for key in _FILE_REF_KEYS:
            ref = _find_file_ref(payload.get(key), _depth + 1)
            if ref:
                return ref
        for key in ("file", "response_data", "data"):
            ref = _find_file_ref(payload.get(key), _depth + 1)
            if ref:
                return ref
    return None


def _save_local(payload: object, dest: str) -> str:
    """Materialise a Composio file reference at `dest`. Returns the path."""
    ref = _find_file_ref(payload)
    if not ref:
        raise GoogleDriveAPIError(
            "save", "No downloadable file reference in the Composio response"
        )
    parent = os.path.dirname(os.path.abspath(dest))
    if parent:
        os.makedirs(parent, exist_ok=True)
    if ref.startswith(("http://", "https://")):
        with urllib.request.urlopen(ref) as resp, open(dest, "wb") as fh:
            shutil.copyfileobj(resp, fh)
    else:
        shutil.copyfile(ref, dest)
    return dest

Technical Analysis

The download helper accepts any string beginning with http:// or https:// from the remote Composio response and retrieves it with urllib.request.urlopen. It does not validate the hostname, resolved address, redirect destination, response size, or transport security beyond recognizing the URL prefix. Cleartext HTTP is ex ...[truncated 2172 chars]

Remediation

View remediation

Remediation Suggestions

• Require HTTPS and reject all cleartext HTTP references.
• Allowlist the documented Composio or approved object-storage hostnames.
• Validate every redirect target against the same hostname and protocol policy.
• Resolve destination paths with realpath and require them to remain under a dedicated workspace download directory.
• Reject absolute paths, traversal outside the approved root, and symlink destinations.
• Avoid silently overwriting existing files unless the user has explicitly confirmed the operation.
• Write to a securely created temporary file and perform an atomic rename after validation.
• Apply restrictive file permissions to downloaded content.
• Enforce download-size and timeout limits.
• Validate local SDK file references against an approved temporary directory before copying them.
• Consider validating expected content type and file format before materializing the response.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a Python script that uses environment variables, writes files to the workspace, and performs networked actions against Google Drive, but the manifest does not declare explicit tool scope such as permissions or allowed-tools. This creates a trust and containment gap: a host agent may permit broader capabilities than a reviewer or runtime policy expects, increasing the risk of unintended data access, export, sharing, or modification through this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When --save-to is used, the code downloads remote content or copies a local file reference directly into the destination path, creating parent directories if needed. Although the CLI argument names imply saving, there is no confirmation prompt or runtime disclosure before writing to the local filesystem at this safety-relevant operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

create-file can read arbitrary local content from --from-file and send that text to the remote Composio/Google Drive tool via _execute. This is a network transmission of local data, but the code provides no explicit user-facing disclosure beyond parameter naming and no warning that local file contents will be uploaded.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.