build-glance
Warn
Audited by Snyk on Mar 24, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's required "custom-api" workflow and docs (see "Custom API Core" and "Dynamic Requests Inside The Template" in references/custom-api-core.md and custom-api-patterns.md) instruct constructing template-side HTTP calls (url, subrequests, newRequest|getResponse) that fetch and parse arbitrary upstream JSON/HTML endpoints, meaning untrusted public third-party content is ingested and can change template logic and widget behavior.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata