arduino
Warn
Audited by Snyk on Mar 7, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly instructs fetching and executing remote content (e.g., "curl -fsSL https://raw.githubusercontent.com/arduino/arduino-cli/master/install.sh | sh") and installing libraries/using additional_urls that pull code from public registries, which are untrusted third‑party sources the agent would ingest/execute as part of its workflow.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill instructs users at runtime to run a shell pipeline that downloads and executes remote code—
curl -fsSL https://raw.githubusercontent.com/arduino/arduino-cli/master/install.sh | sh—which fetches and runs a script and is presented as a required installation step for the skill.
Audit Metadata