wow-api-index
Warn
Audited by Snyk on Mar 5, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's SKILL.md explicitly instructs the agent to fetch wiki pages (e.g., "fetch the wiki page directly: https://warcraft.wiki.gg/wiki/API_") and MAINTENANCE.md directs checking https://warcraft.wiki.gg/wiki/Patch_X.Y.Z/API_changes — both are public, community-driven wiki pages that the workflow requires the agent to read and use to determine API behavior.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.70). The skill explicitly instructs at runtime to fetch https://warcraft.wiki.gg/wiki/API_ (and other warcraft.wiki.gg pages) to obtain missing API documentation that would be injected into the agent's context and thus can directly control prompts.
Audit Metadata