alltuu-downloader
Warn
Audited by Snyk on May 10, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill's download script and SKILL.md explicitly open public album pages on m.alltuu.com and intercept v4c.alltuu.com "fpl" API JSON responses to extract photo URLs, so it ingests untrusted, user-provided third‑party content (album/API responses) that directly drives what the agent downloads and how it behaves.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata