skills/bmad-code-org/bmad-method/bmad-checkpoint-preview/Snyk

bmad-checkpoint-preview

Warn

Audited by Snyk on Apr 26, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (high risk: 0.80). The workflow explicitly resolves PR references via gh pr view (step-01-orientation.md) and reads spec/PR Intent sections verbatim to drive the review, so it ingests user-generated GitHub/PR content (an untrusted third-party source) that can materially influence decisions and actions.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Apr 26, 2026, 05:55 AM

Issues

1