frontend-lp
Warn
Audited by Snyk on Mar 11, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly mandates using MCP tools to fetch external documentation (e.g., mcp__expo-mcp__fetch_npm_docs for npm packages and web searches of magicui.design and tailwindcss.com), meaning the agent will read and act on untrusted public third-party docs that can materially influence its code generation and tool use.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The skill's setup includes pnpm dlx shadcn@latest add "https://magicui.design/r/..." (e.g., https://magicui.design/r/globe, https://magicui.design/r/particles, etc.), which are runtime install commands that fetch and install remote component code that the skill relies on, thereby downloading/executing external code during setup.
Audit Metadata