chaos-engineer
Warn
Audited by Snyk on Mar 7, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's CI/CD workflow (references/chaos-tools.md) explicitly runs kubectl apply -f https://litmuschaos.github.io/litmus/litmus-operator-v2.14.0.yaml and similar public URL fetches as part of executing experiments, so it fetches and acts on untrusted third‑party content (remote manifests) that can materially change tool behavior.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The GitHub Actions workflow runs kubectl apply -f https://litmuschaos.github.io/litmus/litmus-operator-v2.14.0.yaml which fetches and deploys remote Kubernetes manifests at runtime (executing remote code) and is required for the subsequent chaos experiment steps.
Audit Metadata