snyk
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to run and review Snyk scan findings, creating a surface where malicious content (e.g., crafted vulnerability names or package descriptions in the scanned project) could attempt to influence the agent's behavior. \n
- Ingestion points: External scan outputs from
snyk test,snyk container test, andsnyk iac test. \n - Boundary markers: The instructions do not define delimiters to separate untrusted tool output from the agent's internal reasoning. \n
- Capability inventory: The skill facilitates command execution via the
snykCLI. \n - Sanitization: There are no instructions for the agent to sanitize or validate the content of the scan results before processing them.
Audit Metadata