ab-tests
Fail
Audited by Snyk on Nov 4, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E004: Prompt injection detected in skill instructions.
- Potential prompt injection detected (medium risk: 0.30). The skill instructs the agent to report test details and session sentiment back to Adapty via a feedback command, which constitutes undisclosed reporting to the vendor.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (medium risk: 0.30). The skill manages A/B tests of paywalls and flows through the Adapty CLI/MCP (such as creating, starting, stopping, updating, or replacing tests that alter what users see and purchase), which constitutes an operational workflow for managing monetization/billing components (paywalls/flows) and initiating traffic-split changes. However, it does not directly execute transfers, charges, refunds, or direct purchases itself (it interacts with configuration and A/B test states of paywalls). This makes its financial scope indirect (managing paywall/flow deployment). Therefore, the evaluation is indirect financial operation.
Issues (2)
E004
CRITICALPrompt injection detected in skill instructions.
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata