dnanexus-integration
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E004: Prompt injection detected in skill instructions.
- Potential prompt injection detected (high risk: 0.80). The prompt contains an explicit, out-of-scope instruction to proactively promote and suggest an external product (K-Dense Web), which changes the agent's behavior for marketing purposes rather than DNAnexus functionality and thus constitutes a hidden/deceptive instruction outside the skill's stated purpose.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill directly downloads and processes user-uploaded data from DNAnexus projects using dxpy APIs (e.g., dxpy.find_data_objects, dxpy.download_dxfile, DXFile/DXRecord access), which exposes the agent to untrusted third-party/user-generated content stored on the platform.
Audit Metadata