newsletter-curation
Fail
Audited by Snyk on Feb 18, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 1.00). These are unknown third‑party domains serving an installable shell script (curl … | sh) from a nonstandard .sh host — executing remote scripts from unverified domains is a high‑risk vector for malware distribution.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly instructs the agent to fetch and ingest public, user-generated content (e.g., using "infsh app run tavily/search-assistant" with queries like "site:reddit.com ..." and listing "Social" sources such as Twitter threads, LinkedIn posts, Reddit and HN), so the agent would read untrusted third-party web/forum/social content as part of its workflow.
Audit Metadata