migrate-placements
Warn
Audited by Snyk on Nov 6, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). The workflow consumes data from Adapty apps, paywalls, and placements via the Adapty CLI/MCP, which contain user-authored strings (like placement titles and paywall names) that flow into the agent's logic and reports.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 0.70). The skill assists in migrating app placements from paywalls to flows using the Adapty CLI/MCP. This includes invoking commands such as
flows create,flows publish, andplacements create. Because creating and publishing flows and placements configures monetization and in-app purchase presentation in a third-party platform (Adapty) via CLI/MCP commands without an independent service-enforced authentication gate inside the skill's defined workflow, it constitutes a direct financial/purchasing operation without qualifying independent control.
Issues (2)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata