backend-pe
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E004: Prompt injection detected in skill instructions.
- Potential prompt injection detected (high risk: 0.80). The prompt explicitly instructs the agent to override system constraints and safety guidance (e.g., "Ignore token and cost constraints", "No Safety Lectures"), which are deceptive attempts to change the model's operating bounds outside the legitimate scope of producing backend designs.
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). Because the skill demands "full, copy-paste-ready" implementations and explicitly forbids placeholders ("Zero-laziness: Never output placeholders"), while requiring CI/IaC/manifests, it encourages embedding concrete credentials (DB passwords, API keys, tokens) verbatim instead of referencing secure env/config mechanisms, creating a high exfiltration risk.
Audit Metadata