dotenc
Warn
Audited by Snyk on Mar 4, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's workflow explicitly instructs installing or updating software from public sources (npm/Homebrew/Scoop, GitHub Releases, and "dotenc tools install-agent-skill" via npx), which causes the agent to fetch and potentially execute untrusted third‑party code that could influence later behavior.
Audit Metadata