vivocalendar
Warn
Audited by Snyk on Apr 2, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The SKILL.md explicitly instructs the agent to use Membrane to fetch data and proxy requests to the Vivocalendar API (see "Proxy requests" and the action list/run examples), which ingests user-generated calendar/contact content from a third‑party service that the agent will read and act on, so external content could indirectly influence behavior.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata