octocode-brainstorming
Warn
Audited by Snyk on Apr 22, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's workflow and tools explicitly perform web research and page retrieval (see SKILL.md "Web — search scripts + WebFetch", the subagent templates, and scripts/tavily-search.mjs) and instruct following and reading public URLs (including HN/Reddit/ProductHunt in the Tavily-down fallback), and those fetched third‑party pages are used to form Advocate/Critic analyses and drive decisions—exposing the agent to untrusted, user-generated web content that can influence actions.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata