find-opportunities
Warn
Audited by Snyk on Mar 5, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly queries the public Karma Funding Map API (https://gapapi.karmahq.xyz/v2/program-registry/search and /v2/communities as described in SKILL.md Step 3 and references/api-reference.md) and ingests program metadata (e.g., metadata.description, submissionUrl, title, deadlines) from that public/user-submitted registry which the agent reads and uses to decide follow-up queries and what actions/results to present, allowing untrusted third-party content to influence behavior.
Audit Metadata