capgo-live-updates
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The prompt includes examples that embed API keys and private keys directly in CLI commands and config files (e.g.,
capgo login --apikey YOUR_API_KEY,privateKey: 'YOUR_PRIVATE_KEY'), which encourages placing secret values verbatim into generated commands or code — an insecure pattern even though placeholders are used.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). At runtime the CapacitorUpdater is configured to fetch and apply update bundles from the remote update endpoint (e.g., https://api.capgo.app/updates), which directly supplies JavaScript/HTML/CSS that will be executed in the app and thus controls runtime behavior.
Audit Metadata