axiom-cloudkit-ref
Warn
Audited by Snyk on Feb 23, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill explicitly demonstrates fetching and syncing records from CloudKit publicCloudDatabase (see "Raw CloudKit APIs" and "Public Database" sections in SKILL.md) — a public, user-generated data source — and includes required workflow examples (initial/incremental sync, applyDatabaseChanges) that ingest and apply that untrusted content into app state, so third-party content could influence behavior.
Audit Metadata