jules
Warn
Audited by Snyk on Feb 19, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly ingests untrusted, user-generated GitHub content into prompts (e.g., the PR_INFO built via "gh pr view ...`" and the note "AGENTS.md → Jules reads from repo root") which the agent is expected to read and use to create/drive Jules tasks, so third-party content can influence actions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill relies on the remote Jules service (https://jules.google.com) and the jules CLI (installed via npm install -g @google/jules) at runtime to accept prompts, generate results, and return/apply diffs — meaning external content and a remote service directly control instructions and code changes.
Audit Metadata