tsconfig-json-rules

Fail

Audited by Snyk on Apr 25, 2026

Risk Level: CRITICAL
Full Analysis

CRITICAL E004: Prompt injection detected in skill instructions.

  • Potential prompt injection detected (high risk: 1.00). The "Memory Protocol" section mandates reading an internal file (cat .claude/context/memory/learnings.md), recording learnings, and altering assumed context—instructions unrelated to reviewing tsconfig.json rules that request access to internal state and persistence, which is a hidden/deceptive operational instruction outside the skill's stated purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

  • Malicious code pattern detected (high risk: 0.90). The package contains a deliberate "Memory Protocol" prompt-injection that instructs the agent to read a local internal memory file (.claude/context/memory/learnings.md) and record findings, which is a clear attempt to access/exfiltrate internal/secret state and acts as a backdoor-like prompt; no network exfiltration or remote execution appears in the code, but the memory-access directive constitutes high-risk malicious intent.

Issues (2)

E004
CRITICAL

Prompt injection detected in skill instructions.

E006
CRITICAL

Malicious code pattern detected in skill scripts.

Audit Metadata
Risk Level
CRITICAL
Analyzed
Apr 25, 2026, 05:38 PM
Issues
2
Security Audit — snyk — tsconfig-json-rules