upgrade-workflow
Warn
Audited by Snyk on Apr 9, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The workflow explicitly instructs the agent/user to "Read the official changelog/migration guide" and "Check each major dependency's changelog" in Step 1, which requires fetching and interpreting third‑party public webpages (dependency changelogs) that can materially change upgrade decisions.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata