skills/paperclipai/paperclip/check-pr/Snyk

check-pr

Warn

Audited by Snyk on Jul 10, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (high risk: 0.85). Outsider-authored free text from PR/MR/CL descriptions and review/discussion comments (e.g., GitHub issue/PR comments, GitLab MR discussions/notes, Perforce CL descriptions/review comments) is fetched at runtime via gh api/glab api/p4 describe/p4 review and then used for the LLM’s analysis, creating an indirect prompt-injection path.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Jul 10, 2026, 05:08 PM

Issues

1

Security Audit — snyk — check-pr