descript-api
Warn
Audited by Snyk on Mar 14, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly imports media from publicly-accessible URLs and directs the agent to "Read transcript — Use GET /published_projects/{slug}" (share.descript.com) as part of the Social Clip Creation Workflow, so the agent ingests public/user-generated third-party content that is used to craft prompts and drive editing actions.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata