skills/cnife/my-scripts/check-opencode-updates/Snyk

check-opencode-updates

Warn

Audited by Snyk on Mar 19, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (high risk: 0.70). The skill's scripts/check_updates.py directly fetches release JSON from public GitHub API endpoints (e.g., https://api.github.com/repos/.../releases and /releases/latest) and ingests untrusted, user-generated release "body" text as part of its workflow to decide/report updates and display release notes, which could carry indirect prompt injection.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Mar 19, 2026, 06:20 AM

Issues

1