pypi-doppler
Warn
Audited by Snyk on Feb 28, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). This skill fetches and interprets public PyPI data as part of its workflow (SKILL.md's "MANDATORY: Verify Version Increment Before Publishing" and scripts/publish-to-pypi.sh Step 5 which curls https://pypi.org/pypi/${PACKAGE_NAME}/${CURRENT_VERSION}/json), so untrusted, user-published content from PyPI is read and can influence publish decisions.
Audit Metadata