gram
Fail
Audited by Snyk on Feb 23, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The CLI explicitly accepts and documents passing sensitive cookies via flags (e.g., --session-id, --csrf-token, --ds-user-id), which encourages embedding secret values directly in generated commands/outputs, creating a high exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill's SKILL.md shows it fetches Instagram content (feeds, posts, comments, profiles—e.g., "gram post", "gram comments", "gram feed", "gram explore") which are untrusted, user-generated third-party pages and the CLI both reads them and can perform actions (like/comment/follow), so third-party content could materially influence behavior.
Audit Metadata