github-api
Fail
Audited by Snyk on Feb 18, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The skill includes explicit examples that embed bearer tokens/credentials directly in commands (e.g., curl -H "Authorization: Bearer YOUR_TOKEN") and instructs executing operations "with appropriate authentication," which encourages collecting and inserting secrets verbatim into outputs.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly issues API calls to the public GitHub API (e.g., https://api.github.com and endpoints like repos/*/issues, pulls, gists, and repository contents) and is designed to read and act on issues, PRs, comments, gists and code — all user-generated public content that could carry untrusted instructions.
Audit Metadata