feat: composio optional skill — 1000+ SaaS connectors via one API key

[teknium1]

Summary

New composio optional skill: the agent can now act on 1000+ SaaS apps — Gmail, Google Calendar/Drive, GitHub, Slack, Notion, Linear, Airtable, HubSpot, Jira, and more — through Composio's hosted connector platform, with OAuth flows and connected accounts managed by Composio. One COMPOSIO_API_KEY in .env unlocks the whole surface. Second step of the Centaur-2.0-parity track ("connect to everything you have access to"), on the footprint ladder's preferred rung: CLI helper + skill, zero model-tool schema cost.

Changes

• optional-skills/productivity/composio/scripts/composio_cli.py: typer-free stdlib CLI over the Composio Python SDK — toolkits / tools / search / schema / execute / connect / wait, JSON-only output, fail-closed on missing key, wire errors surfaced verbatim
• optional-skills/productivity/composio/SKILL.md: modern section order, ≤60-char description, terminal-driven workflow, OAuth-handoff pitfall documented (agent hands the URL to the user, never completes OAuth itself)
• hermes_cli/config_defaults.py: COMPOSIO_API_KEY registered in OPTIONAL_ENV_VARS (password, category tool)
• tests/skills/test_composio_skill.py: 8 tests — frontmatter contract, fail-closed key check, arg validation, schema lookup, error surfacing, env-var registration

Validation

Check	Result
scripts/run_tests.sh tests/skills/test_composio_skill.py	8 passed, 0 failed
Live no-key run (composio_cli.py toolkits)	fail-closed JSON error + exit 1
SKILL.md description length	56 chars

Install: hermes skills install official/productivity/composio

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 12e368d — feat: composio optional skill — 1000+ SaaS connectors (Gmail}

⚠️ Warnings

OSV vulnerability scan · View job

2 known vulnerabilities found in pinned dependencies.

• CVE-2026-70608 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 3m9s vs 7m30s (-58.0%). 13 job(s) slower, 12 faster, 1 unchanged.

• Python tests / Run tests slice 10/12: -47.0s
• Detect affected areas: -33.0s
• Python lints / Windows footguns (blocking): -32.0s
• Python tests / Run tests slice 12/12: -29.0s
• Python tests / Run tests slice 4/12: +26.0s

[alt-glitch]

This was generated by AI during triage.

Duplicate of #36730: both add an optional Composio CLI skill for the same hosted connector surface.

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

feat: composio optional skill — 1000+ SaaS connectors via one API key

1. SKILL.md frontmatter sets author: Hermes Agent. The repo's skill authoring standard (Fix terminal interactivity #4) requires the human contributor's real name + GitHub handle first, with "Hermes Agent" only as the secondary collaborator. If a human authored this skill, please credit them.
2. scripts/composio_cli.py cmd_execute: dangerously_skip_version_check=True executes whatever server-side version the slug currently maps to, which may differ from the schema the agent just fetched via schema — the skill's own Pitfalls section notes that arguments drift. Consider pinning the version returned alongside the schema, or at least surfacing the resolved version in the execute response so the agent can spot drift.
3. cmd_connect wraps the preferred toolkits.authorize path in a bare except Exception: pass — any failure (auth config, network, SDK API change) is silently masked before the fallback path runs, which can produce a confusing error later. Log the swallowed exception at debug level.
4. Wiring is correct per repo policy: COMPOSIO_API_KEY in OPTIONAL_ENV_VARS with password: true, skill placed under optional-skills/, tests stub the SDK with no network calls. The frontmatter test reads SKILL.md (a data file, not source code) — consistent with the repo's own description-length check. No issue there.