raffle-winner-picker
Warn
Audited by Snyk on Mar 6, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to "Pick a random row from this Google Sheet" and includes workflows that ingest entries exported to Google Sheets (public or user-submitted form responses), meaning the agent fetches and interprets untrusted, user-generated spreadsheet content as part of its selection process (SKILL.md "From Google Sheets" and "Social Media Giveaway" workflows).
Audit Metadata