galaxy-workflow-development
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The prompt includes a Planemo example using "--galaxy_user_key YOUR_API_KEY", which instructs embedding an API key as a command-line argument — an insecure pattern that could require the LLM to include secret values verbatim.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill instructs workflow tests to reference and download public, user-hosted test data (e.g., "Large Input: location: https://zenodo.org/records/XXXXXX/files/file.fastq.gz") and describes data-fetching steps (e.g., fetching SRA accessions), so the agent's workflow is expected to ingest untrusted third-party content.
Audit Metadata