brandapp-sdk-install
Warn
Audited by Snyk on May 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md instructs the generated app to call the remote Reopt API (e.g., sdk.cms.posts.getBySlug and sdk.cms.posts.list in the "External marketing site" examples and the Step 5 SDK connectivity check using sdk.eav.entities.list), which fetches third-party/consumer CMS and EAV data from brand.reopt.ai that the app reads and uses to drive metadata, sitemap/RSS generation, and control flow (401/404 handling), so untrusted external content can materially influence behavior.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata