val-town-cli

Warn

Audited by Snyk on Feb 16, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

  • Third-party content exposure detected (high risk: 0.80). The skill's CLI workflows explicitly fetch and interact with public, user-created vals (e.g., "vt clone username/valName", "vt clone https://www.val.town/...", "vt remix ...", and "vt tail @user/valName"), which means it ingests untrusted third-party code/content from val.town that could carry indirect prompt-injection risks.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 16, 2026, 12:26 AM