event-impact-analyzer
Fail
Audited by Snyk on Mar 8, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The skill mandates checking for KIS_APP_KEY/KIS_SECRET_KEY and, if absent, telling the user to provide the missing values or store them in a file—forcing the agent to solicit and potentially receive API secrets in chat (exfiltration risk), even though it prefers local env/config and doesn't explicitly require embedding them into commands.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The SKILL.md workflow and "Web research rules" explicitly require using web search to interpret user-provided URLs and to identify/verify event dates and analogs, meaning the agent will fetch and ingest arbitrary public web content (third‑party/untrusted) that directly drives analysis and decisions.
Audit Metadata