app-clip
Warn
Audited by Snyk on Jun 18, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.75). The skill’s runtime path ingests outsider-authored free text via
NSUserActivityTypeBrowsingWeb→userActivity.webpageURL→InvocationHandler.handleInvocation(url:)→parseURL(_:), where the URL (including query/path strings) originates from the user’s external invocation source (e.g., NFC/QR/Safari/Messages) and is not authored by the operating user.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata