backend-inferencer
Fail
Audited by Snyk on Mar 9, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The skill explicitly appends raw header/cookie/DNS TXT values into its output (e.g., "Cookie: {cookie}", "Server: {server_header}"), which can contain session tokens, API keys, or verification TXT records and therefore requires the LLM to include secrets verbatim.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The skill explicitly ingests and interprets external website and repo content — e.g., http_signals (Server headers, X-Powered-By, cookies), html_signals (generator meta tags, script URLs), and repository_signals (github.com/example/repo) as shown in SKILL.md and the inference logic, so untrusted third-party pages/repos can materially influence detection and subsequent decisions.
Audit Metadata