hn-search
Warn
Audited by Snyk on Feb 19, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly instructs the agent to fetch and parse public, user-generated Hacker News stories and comments from the Algolia HN Search API (https://hn.algolia.com/api/v1) and to read/present story_text and comment_text as part of its workflow, which exposes it to untrusted third-party content that could contain indirect prompt-injection.
Audit Metadata