runpod
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows and encourages configuring runpodctl with an API key passed verbatim on the command line (
runpodctl config --apiKey "your-api-key"), which would require the LLM to include secret values directly in generated commands/outputs and is an insecure pattern.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly mounts and SSHs into user-run RunPod instances (via sshfs and runpodctl) and exposes proxy.runpod.net URLs for pod-hosted web UIs, meaning the agent would read arbitrary pod-hosted files and web pages from untrusted third-party sources.
Audit Metadata