post-newsletter
Fail
Audited by Snyk on Oct 8, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user for their community credentials and export them as plain text environment variables before executing an authentication API request.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (low risk: 0.10). The required workflow fetches and processes external Substack newsletter content via user-provided URLs using WebFetch.
Issues (2)
W007
HIGHInsecure credential handling detected in skill instructions.
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata