android-dev
Warn
Audited by Snyk on Mar 9, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's instructions and code explicitly fetch and process open web content (e.g., Retrofit configured with https://newsapi.org/ in references/networking-serialization.md, Coil AsyncImage loading arbitrary https image URLs in the same file, DownloadService that accepts a download URL from an intent in references/background-work.md, and FCM message handling in the FCM section) so untrusted third-party content is ingested and directly influences app behavior and decision paths.
Audit Metadata