world-labs-api
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes examples that hard-code or directly place the API key into curl headers and Python variables (e.g., "WLT-Api-Key: YOUR_API_KEY" and API_KEY = "your_api_key"), which instructs embedding secret values verbatim in commands/code.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill ingests and uses user-provided/untrusted media as inputs (see "Media Asset Upload Workflow" with prepare_upload/upload and the use of media_asset_id in world_prompt) and returns world assets/URLs (thumbnail_url, pano_url, world_marble_url) that the agent is expected to read or use as part of generation.
Audit Metadata