windows-git-bash-compatibility
Warn
Audited by Snyk on Feb 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). deploy-adf.sh uses curl to download and then invoke a PowerShell script from a public raw.githubusercontent.com URL (https://raw.githubusercontent.com/Azure/Azure-DataFactory/main/.../PrePostDeploymentScript.Ver2.ps1), so the skill fetches and executes content from an open third-party source, exposing it to untrusted public content and potential indirect prompt/instruction injection.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The deploy script uses curl at runtime to fetch and then execute a PowerShell script from https://raw.githubusercontent.com/Azure/Azure-DataFactory/main/SamplesV2/ContinuousIntegrationAndDelivery/PrePostDeploymentScript.Ver2.ps1, so the fetched content directly executes remote code and is a required runtime dependency.
Audit Metadata