skills/paperclipai/paperclip/garden-inbox/Snyk

garden-inbox

Warn

Audited by Snyk on Aug 3, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (medium risk: 0.30). In the required scan runtime workflow, garden-inbox.mjs calls the Mine inbox endpoint (/agents/me/inbox/mine?{userId,status}) and ingests the returned inbox row free text (e.g., issue.title, identifier, blocker attention fields) before writing garden-inbox-report.md and candidates.json.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Aug 3, 2026, 10:21 AM

Issues

1

Security Audit — snyk — garden-inbox