sparc-methodology
Warn
Audited by Snyk on Mar 4, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly describes a "researcher" mode that performs "parallel WebSearch/WebFetch" and options like sources/citations (e.g., "researcher: Deep research with parallel WebSearch/WebFetch" and example usages requesting academic/industry/news sources), which shows the agent fetches and ingests open public web content that it reads and uses to drive decisions and workflows.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The skill's runtime activation method includes explicit NPX commands (e.g., "npx claude-flow" / "npx claude-flow@alpha") which will fetch and execute remote package code from https://www.npmjs.com/package/claude-flow, so this URL represents a runtime external dependency that can execute remote code.
Audit Metadata