webots-proto
Warn
Audited by Snyk on Mar 4, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs loading remote PROTOs from URLs (SKILL.md "Scene Tree Usage and Discovery" mentions "remote PROTO usage from URL-based declarations (including webots.cloud hosted assets)" and references/proto_reference.md section 9 "Remote PROTO Loading" describes EXTERNPROTO with HTTPS URLs), which means the agent would fetch and interpret untrusted, public .proto content (including procedural JS) that can alter generated node behavior.
Audit Metadata