kelly-deal-scorer
Warn
Audited by Snyk on Aug 25, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). In the live runtime path, the AirApp reads outsider-authored Busabase record fields from
candidates(viacontent/kelly-deal-scorer-app/app/js/providers/busabase-provider.js→readAllRecords("candidates")) and then ingests that free text/JSON (e.g.,business_name,city,red_flags,monthly_revenue,decision_comment) into the UI for scoring display.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata