beam-master
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the AI to ask the user to "Paste your Beam API key here" and then to write that key directly into a .env file (and includes examples/CLI patterns accepting tokens), which requires the LLM to receive and output secret values verbatim.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's create_task.py explicitly accepts a --urls parameter ("Comma-separated URLs to parse"), which lets the agent fetch and ingest arbitrary public URLs (untrusted, user-provided web content) as part of task execution, exposing it to indirect prompt injection.
Audit Metadata