create-cast
Warn
Audited by Snyk on Mar 17, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill calls an external "discover-talent" skill (see create_cast/reference_finder.py and SKILL.md Round 2 / AGENTS.md with TMDB_API_KEY) to fetch public actor results and images, then uses those untrusted, third-party actor names/URLs as inputs (e.g., identity_generator.build_identity_prompt) that materially influence prompt construction and downstream image/voice generation decisions, enabling indirect prompt injection.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata