ai-content-pipeline
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.70). Most links are documentation and image assets on inference.sh (low risk), but the CLI endpoint—explicitly recommended in the prompt with "curl -fsSL https://cli.inference.sh | sh"—is high-risk because piping and executing a remote shell script can deliver malware, and the placeholder-like external URL "https://your-music.mp3" is untrusted/suspicious.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly ingests public/untrusted content in its Research and Blog-to-Video examples — e.g., the "Pattern 3: Research -> Content -> Distribution" and "Blog to Video Pipeline" use tavily/search-assistant and an LLM prompt "Summarize this blog post into 5 key points: ", which requires fetching and interpreting arbitrary web/user-provided content.
Audit Metadata