cerbos-synapse-extension

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill tells the agent to collect/substitute the distribution repo and to run docker login ... --password=YOUR_LICENCE_KEY, which requires embedding a user’s license key/password verbatim into generated commands (an insecure secret-handling pattern).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Yes — several URLs point to arbitrary cloud storage or script-hosting endpoints (S3, GCS, and a custom scripts host) that can deliver executable artifacts (.wasm or code) from untrusted sources and are therefore higher-risk distribution vectors.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Synapse’s routeExtensions (Starlark) ingest arbitrary outsider HTTP request fields (e.g., req.path, req.query_params, req.body) at runtime via handleHTTPRoute(req) under /ext/..., which are then processed by the extension/LLM logic.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Multiple files show that Synapse can load extensions over networked URLs at runtime (e.g. "wasm+s3::https://s3.amazonaws.com/bucket/ext.wasm", "starlark+gcs::https://www.googleapis.com/storage/v1/bucket/ext.star", "wasm+git::ssh://git@github.com/org/repo//ext.wasm?ref=v1.0.0" and "starlark+https://scripts.example.com/ext?checksum=sha256:..."), and the build pipeline Dockerfile fetches and extracts remote release assets from GitHub (https://api.github.com/.../releases/latest), so remote content is fetched during build/startup and can supply/execute extension code.