stitch-loop
Warn
Audited by Snyk on Jun 12, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill is sourced from a public GitHub repository (“Upstream: https://github.com/google-labs-code/skills”) and the runtime workflow likely ingests README/asset text from that outsider-authored web content into the agent’s LLM context when installing/running the upstream bundle.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata