cloudflare-turnstile
Warn
Audited by Snyk on Feb 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill includes scripts/check-csp.sh which calls curl on a user-supplied URL and parses the target site's CSP/headers (and templates show runtime fetches of external endpoints), so it clearly fetches and interprets untrusted public web content supplied at runtime.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The skill explicitly loads and requires the remote runtime script https://challenges.cloudflare.com/turnstile/v0/api.js (via ) which executes third‑party JavaScript in clients at runtime and is a required dependency for the widget to function, so it constitutes a runtime external resource that executes remote code.
Audit Metadata