python-project
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.90). The presence of a direct curl|sh install from an unverified domain (https://astral.sh/uv/install.sh) is a high-risk pattern for malware distribution (piping remote .sh to sh), while http://localhost:4000 and http://test are local/test endpoints and not external download hosts.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill includes examples that fetch and parse arbitrary external URLs (e.g., reference/patterns.md "fetch_data" and "fetch_all" using httpx.Client.get(url) which return response.json()), so the agent can ingest untrusted, user-provided web content at runtime.
Audit Metadata