protocolsio-integration
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The skill explicitly shows and requires embedding an access token in Authorization headers and inline code (e.g., token = "YOUR_ACCESS_TOKEN" and Authorization: Bearer YOUR_TOKEN), which would force the agent to handle or emit secret values verbatim in generated requests or code.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill fetches public, user-generated content from the protocols.io API (e.g., GET /protocols, GET /protocols/{protocol_id}, and GET /protocols/{id}/comments via https://protocols.io/api/v3), so the agent would read and interpret untrusted third-party protocols and comments.
Audit Metadata