dependency-updater
Warn
Audited by Snyk on Mar 6, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). This skill's workflow and command examples in SKILL.md (e.g., "taze", "pip list --outdated", "go list -m -u all", "cargo outdated") perform language-specific outdated checks that fetch package metadata from public registries (npm, PyPI, Go modules, etc.), which is user-published/untrusted content that the agent reads and uses to decide and apply updates.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill includes an installation command that fetches and installs a remote Go package at runtime (mise use go:golang.org/x/vuln/cmd/govulncheck@latest), which will download and execute remote code and is relied upon for the skill's security checks.
Audit Metadata