migrate-placements

Warn

Audited by Snyk on Nov 6, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

  • Third-party content exposure detected (medium risk: 0.30). The workflow consumes data from Adapty apps, paywalls, and placements via the Adapty CLI/MCP, which contain user-authored strings (like placement titles and paywall names) that flow into the agent's logic and reports.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 0.70). The skill assists in migrating app placements from paywalls to flows using the Adapty CLI/MCP. This includes invoking commands such as flows create, flows publish, and placements create. Because creating and publishing flows and placements configures monetization and in-app purchase presentation in a third-party platform (Adapty) via CLI/MCP commands without an independent service-enforced authentication gate inside the skill's defined workflow, it constitutes a direct financial/purchasing operation without qualifying independent control.

Issues (2)

W011
MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 6, 2026, 02:48 PM
Issues
2