tauri-guide
Warn
Audited by Snyk on Feb 18, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill includes runtime handling of open, third-party content — notably fetching and parsing update manifests from external endpoints (e.g., GitHub Releases / CrabNebula / self-hosted "endpoints" in the auto-updates guide) and parsing/acting on arbitrary deep-link URLs (myapp://...) — both of which involve reading untrusted external/user-provided data as part of the app's workflow.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The guide configures runtime auto-update endpoints (e.g. "https://your-update-server.com/update/{{target}}-{{arch}}/{{current_version}}" and CDN/GitHub release URLs) that the app's updater checks and downloads/install binaries from at runtime, which can deliver and execute remote code.
Audit Metadata