tweet-replies
Warn
Audited by Snyk on Apr 27, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and paginates public, user-generated replies from X via GET /x/tweets/{id}/replies on https://xquik.com/api/v1 (see "Typical flow" steps 1–3 in SKILL.md), and those reply texts are read and used to surface/top replies — meeting the criteria for untrusted third-party content that could carry indirect prompt-injection.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata