late-api
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt's examples show embedding an API key directly in curl Authorization headers (e.g., -H "Authorization: Bearer YOUR_API_KEY"), which encourages including secret values verbatim in generated commands or code.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's Tools API documentation (rules/tools.md) includes endpoints that download media and transcripts from arbitrary public social URLs (e.g., /v1/tools/instagram/download?url=..., /v1/tools/youtube/transcript?url=...), meaning the agent may fetch and process untrusted, user-generated content from the open web.
Audit Metadata