NYC

deployment-pipeline

Fail

Audited by Snyk on Feb 16, 2026

Risk Level: CRITICAL
Full Analysis

CRITICAL E004: Prompt injection detected in skill instructions.

  • Potential prompt injection detected (medium risk: 0.60). The prompt explicitly states it "Does NOT cover Docker image building" yet repeatedly includes Docker build/image instructions and CI steps—this contradiction is a deceptive misalignment with the stated scope, though there are no obfuscated/secret-exfiltration instructions or "ignore previous" overrides.

HIGH W007: Insecure credential handling detected in skill instructions.

  • Insecure credential handling detected (high risk: 1.00). The prompt includes plaintext credentials embedded in example configs/commands (e.g., POSTGRES_PASSWORD: testpass and a DATABASE_URL containing testpass), which are insecure patterns that would cause the model to reproduce secret values verbatim in outputs.
Audit Metadata
Risk Level
CRITICAL
Analyzed
Feb 16, 2026, 12:27 AM