dependency-upgrade
Warn
Audited by Snyk on Mar 7, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill explicitly fetches and executes public, user-maintained content (e.g., curl https://raw.githubusercontent.com/facebook/react/master/CHANGELOG.md and npx jscodeshift -t https://raw.githubusercontent.com/reactjs/react-codemod/... in the "Breaking Change Handling" section), so the agent would read and act on untrusted third-party content that could alter tool behavior.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill contains commands that invoke jscodeshift with a remote transform URL (e.g., https://raw.githubusercontent.com/reactjs/react-codemod/master/transforms/rename-unsafe-lifecycles.js), which will be fetched at runtime and executed as code, satisfying the criteria for a runtime external dependency that executes remote code.
Audit Metadata