deployment-pipeline
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E004: Prompt injection detected in skill instructions.
- Potential prompt injection detected (medium risk: 0.60). The prompt explicitly states it "Does NOT cover Docker image building" yet repeatedly includes Docker build/image instructions and CI steps—this contradiction is a deceptive misalignment with the stated scope, though there are no obfuscated/secret-exfiltration instructions or "ignore previous" overrides.
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes plaintext credentials embedded in example configs/commands (e.g., POSTGRES_PASSWORD: testpass and a DATABASE_URL containing testpass), which are insecure patterns that would cause the model to reproduce secret values verbatim in outputs.
Audit Metadata