social-trend-monitor
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: HIGH
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill explicitly monitors and ingests public social-media content from Reddit, Instagram, TikTok, and Twitter (user-generated, untrusted third-party sources) to generate trend reports, so the agent will read and interpret arbitrary external content that could contain indirect prompt-injection.
HIGH W008: Secret detected in skill content (API keys, tokens, passwords).
- Secret detected (high risk: 1.00). The string "skp-wlkolg0ekczlstqpaly6cyvy" is a high-entropy, literal token included directly in the installation command. It is not a documented placeholder (e.g., "YOUR_API_KEY" or "sk-xxxx"), not truncated/redacted, and not a simple example password, so it appears to be a real, usable credential/installation token. Therefore it should be flagged as a hardcoded secret.
Audit Metadata