github-actions-inspection
Warn
Audited by Snyk on Aug 18, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). In the GitHub Actions Inspection skill workflow, runtime uses the gh CLI/API to select and ingest GitHub Actions run details and log text from existing runs (e.g.,
gh run view ... --log-failed,gh run download, andgh api .../actions/runs/<run-id>/logs), which can include outsider-authored free text from commits/PRs and log output without any need to fetch a specific externally authored item beyond choosing a run-id.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata