github-trending
Warn
Audited by Snyk on Aug 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). SKILL.md’s required workflow fetches outsider-authored free text at runtime by scraping GitHub’s trending HTML (WebFetch/curl from https://github.com/trending?since=daily, then extracting repo one-line descriptions) and ingesting Hugging Face trending JSON fields (models/datasets/spaces descriptions/titles via curl/WebFetch from https://huggingface.co/api/*).
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata