skills/maddhruv/absolute/a2ui/Snyk

a2ui

Fail

Audited by Snyk on Apr 4, 2026

Risk Level: CRITICAL

Full Analysis

CRITICAL E004: Prompt injection detected in skill instructions.

Potential prompt injection detected (high risk: 1.00). The "Companion check" secretly instructs the agent to run shell commands to enumerate local skill directories and to offer/install missing skills (npx skills add) on first activation — system-level actions unrelated to A2UI's stated purpose, so this is a hidden/deceptive instruction.

Issues (1)

E004

CRITICAL

Prompt injection detected in skill instructions.

Audit Metadata

Risk Level

CRITICAL

Analyzed

Apr 4, 2026, 05:22 AM

Issues

1

Security Audit — snyk — a2ui