app-clips
Warn
Audited by Snyk on Mar 8, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill explicitly processes invocation webpage URLs from third-party websites via NSUserActivity.webpageURL (see "Invocation URL Handling") and relies on associated domains/AASA-hosted URLs, meaning untrusted public URLs are ingested and parsed to drive app behavior.
Audit Metadata