testing-ci
Warn
Audited by Snyk on Mar 7, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's Integration Notes explicitly instruct fetching and executing a third-party script ("curl -Os codecov.io/bash && bash codecov -t $CODECOV_TOKEN") and also integrates with public GitHub APIs, meaning it ingests and acts on open/public third‑party content that could influence actions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime command that downloads and executes remote shell code via "curl -Os codecov.io/bash && bash codecov -t $CODECOV_TOKEN", meaning the URL codecov.io/bash is fetched at runtime and its contents are executed, which directly runs external code.
Audit Metadata