pr-dashboard
Warn
Audited by Snyk on Apr 30, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's CLI (scripts/pr-dashboard-cli.mjs) calls the GitHub CLI (gh api) to fetch user-generated PR data (titles, bodies, reviews, commit status) from public GitHub repositories and then inserts the returned PR body HTML (pr.bodyHtml) into the generated dashboard HTML, so untrusted third-party content is clearly ingested and displayed as part of the workflow.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata