last30days
Warn
Audited by Snyk on Mar 9, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md and scripts/last30days.py explicitly fetch and ingest content from open public sources (reddit.com, x.com via a bundled Twitter GraphQL client, YouTube via yt-dlp transcripts, hn.algolia.com, gamma-api.polymarket.com, and arbitrary web pages) and requires the agent to read and synthesize that third‑party output to drive decisions and generate prompts, creating a clear channel for indirect prompt injection.
Audit Metadata