atxp
Fail
Audited by Snyk on Mar 4, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt explicitly tells the user/agent to run
echo $ATXP_CONNECTION, which would print the secret value verbatim (exposing it in output) even though other usages rely on env vars, so it requires handling/outputting secrets directly.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill explicitly performs real-time web and X/Twitter searches (see SKILL.md Commands:
npx atxp search <query>andnpx atxp x <query>, plus the Usage and Programmatic Access sections) and instructs the agent to parse and present/summarize those results, meaning untrusted, user-generated third‑party content can influence subsequent actions.
Audit Metadata