hap-frontend-project
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). This skill explicitly instructs extracting HAP Appkey/HAP-Sign (from MCP URLs or manual copy) and placing them into config.js and request headers, which requires the LLM/agent to handle and output secret values verbatim.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly instructs the agent to call HAP APIs (e.g., get_worksheet_structure, getRows against https://api.mingdao.com and private HAP hosts) and to read/render worksheet rows, attachments and user-provided fields — i.e., ingesting and interpreting arbitrary user-generated data from third-party HAP instances and external image URLs.
Audit Metadata