large-file-refactorer
Warn
Audited by Snyk on Mar 1, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's install/update workflow explicitly runs curl on raw.githubusercontent.com (see README.md "Global/Local Installation" and commands/* Step 1 for --update-skill) which fetches and executes public GitHub-hosted scripts—untrusted third-party content that can change agent behavior at runtime.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill's runtime update/install steps explicitly run remote install scripts via curl piped to bash (e.g., https://raw.githubusercontent.com/Alcyone-Labs/large-file-refactorer/main/install.sh and https://raw.githubusercontent.com/Alcyone-Labs/agent-skills/main/install.sh) which fetch and execute remote code at runtime, creating a high-risk execution-of-remote-code vector.
Audit Metadata