b2c-mrt
Fail
Audited by Snyk on Mar 3, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The prompt includes examples that set and pass API keys/secrets inline (e.g.,
b2c mrt env var set API_KEY=secret,export SFCC_MRT_API_KEY=your-api-key, and a ~/.mobify JSON with "api_key"), which would require the agent to embed user-provided secret values verbatim into commands or files.
Audit Metadata