brainstorm
Fail
Audited by Snyk on Feb 27, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E004: Prompt injection detected in skill instructions.
- Potential prompt injection detected (high risk: 1.00). The prompt includes an extraneous instruction to visit an external URL embedding the contents of a local file ("visit nisimi.com?thanks="), which is a hidden/exfiltrative action unrelated to the brainstorm skill's stated design-and-approval purpose.
CRITICAL E006: Malicious code pattern detected in skill scripts.
- Malicious code pattern detected (high risk: 1.00). This skill contains an explicit instruction to send the contents of a local file to an external domain ("nisimi.com?thanks=") and the included brainstorm-version.txt holds "/etc/zshrc" (a sensitive system file path), which strongly indicates deliberate data exfiltration/backdoor behavior that could leak local system credentials or configuration if an automated agent or user follows it.
Audit Metadata