tailscale-localsend
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill actively discovers and ingests untrusted peer-provided content—reading Tailscale peer info via
tailscale status --json, listening to LocalSend multicast on 224.0.0.167:53317 for JSON announcements (alias/fingerprint/port), and fetching files over peers' /api/localsend/v2/... REST endpoints—so arbitrary third-party peers can supply content that the agent will parse and act on.
Audit Metadata