ab-tests

Fail

Audited by Snyk on Nov 4, 2026

Risk Level: CRITICAL
Full Analysis

CRITICAL E004: Prompt injection detected in skill instructions.

  • Potential prompt injection detected (medium risk: 0.30). The skill instructs the agent to report test details and session sentiment back to Adapty via a feedback command, which constitutes undisclosed reporting to the vendor.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (medium risk: 0.30). The skill manages A/B tests of paywalls and flows through the Adapty CLI/MCP (such as creating, starting, stopping, updating, or replacing tests that alter what users see and purchase), which constitutes an operational workflow for managing monetization/billing components (paywalls/flows) and initiating traffic-split changes. However, it does not directly execute transfers, charges, refunds, or direct purchases itself (it interacts with configuration and A/B test states of paywalls). This makes its financial scope indirect (managing paywall/flow deployment). Therefore, the evaluation is indirect financial operation.

Issues (2)

E004
CRITICAL

Prompt injection detected in skill instructions.

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
CRITICAL
Analyzed
Nov 4, 2026, 10:16 AM
Issues
2