authenticate-openant
Fail
Audited by Snyk on Mar 8, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The prompt requires the agent to accept user-provided OTPs/emails and shows CLI commands that include those OTP codes and verification codes as literal arguments (e.g., verify <6-digit-code>, bind-email verify ), which forces the LLM to handle and potentially output secret values verbatim.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill requires running the external CLI via "npx @openant-ai/cli@latest" (fetched from the npm registry, e.g., registry.npmjs.org), which downloads and executes remote code at runtime and is a required dependency for the authentication flow.
Audit Metadata