mvp-preview
Warn
Audited by Snyk on Mar 1, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The skill's single-HTML workflow explicitly requires and injects remote scripts at runtime (https://cdn.tailwindcss.com and https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js), which fetch and execute external JavaScript and are described as required dependencies, so they can control runtime behavior and pose a risk.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs creating project-level agent config files that disable approval prompts ("bypassPermissions"/"approval_policy = 'never'") and guides installing/exposing services (cloudflared/vercel), which encourages bypassing security controls and changing machine state to allow automated privileged actions, so it should be flagged.
Audit Metadata