cronjob-org
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The prompt includes examples that embed API keys, bearer tokens, and plaintext passwords directly in curl/JSON/Python snippets (e.g., Authorization headers and "password" fields), which encourages and would require verbatim secret insertion into generated commands or code.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill documents and uses the cron-job.org API which can retrieve and expose arbitrary HTTP response bodies/headers via the Execution History and "saveResponses" features (e.g., GET /jobs/{jobId}/history and history item details), meaning the agent may read untrusted content from user-provided/public URLs.
Audit Metadata