import-on-interaction
Warn
Audited by Snyk on Apr 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly instructs dynamically loading and executing third-party widgets and scripts (e.g., YouTube Lite Embed, Intercom, and loading //apis.google.com/js/client as shown in the "Video Player Embeds" / "Chat widgets" and example code), which pulls untrusted, user-generated public web content into the runtime and can materially change behavior when executed.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata