project-development
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The skill's "Acquire" stage and Example 1 (Karpathy's HN Time Capsule) explicitly describe fetching and analyzing public Hacker News discussions and other external web sources—user-generated, untrusted content that the agent would ingest and interpret—exposing it to potential indirect prompt injection.
Audit Metadata