devic-ui
Fail
Audited by Snyk on Mar 9, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The prompt repeatedly shows and encourages placing API keys directly into component props and client constructors (e.g., apiKey="your-devic-api-key" and DevicApiClient({ apiKey: 'your-api-key' })), which promotes embedding secrets verbatim in generated code or outputs and thus creates a high exfiltration risk.
Audit Metadata