api-fetcher
Fail
Audited by Snyk on Mar 3, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The skill shows and documents passing Authorization headers and other credentials directly on the command line (e.g., --headers '{"Authorization":"Bearer token"}'), which encourages the LLM to embed secret values verbatim into generated commands/requests, creating an exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). This skill explicitly requires an arbitrary --url (SKILL.md and src/index.ts) and uses secureFetch to ingest and interpret the returned response (src/lib.ts), including checking GraphQL errors and running schema validation, so untrusted third-party responses can directly influence validation and returned data used for downstream decisions.
Audit Metadata