build-a-skill
Fail
Audited by Snyk on Mar 1, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes an explicit CLI example that passes an API token as a command-line argument ("askill login --token ask_xxxxxxxxx..."), which instructs embedding a secret value verbatim and therefore creates an exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). This skill's Publish Workflow explicitly allows publishing from arbitrary GitHub SKILL.md URLs (see "askill publish --github https://github.com/owner/repo/blob/main/path/to/SKILL.md" and "askill submit "), so the agent would fetch and act on public, user-generated third‑party content that could influence publish/metadata behavior.
Audit Metadata