translate-mom-tweets
Warn
Audited by Snyk on Feb 23, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches top tasks from the open translate.mom API (GET http://plausible.translate.mom:8001/top-tasks or via TRANSLATE_MOM_API) and downloads SRT files from the srtFiles URLs, then reads and interprets subtitle dialogue to generate tweet drafts, which means it ingests untrusted, user-generated third‑party content that directly influences its outputs and actions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill runtime fetches tasks from http://plausible.translate.mom:8001/top-tasks?date=... and then curl's external SRT URLs (e.g., https://...srt-url...) and injects those subtitle files into the model context to drive the tweet-generation prompts, so these runtime-fetched URLs directly control the agent's output.
Audit Metadata