shemic-dever
Warn
Audited by Snyk on Mar 1, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches and executes public third-party code (e.g., "go get" and "go run github.com/shemic/dever@... init --skip-tidy" called from SKILL.md and scripts/boot.sh and scripts/module.sh), so untrusted GitHub-hosted content is ingested and its generated output is relied upon to drive subsequent generation and decisions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill's scripts explicitly run and fetch remote Go modules (e.g., go get "github.com/shemic/dever@${DEVER_VERSION}" and go run "github.com/shemic/dever/cmd/dever@${DEVER_VERSION}") and the README suggests git cloning git@github.com:shemic/skills-dever.git, which cause remote code to be fetched and executed at runtime and are required for the skill to function.
Audit Metadata