skills/scavio-ai/hermes-agent/product-deep-research/Snyk

product-deep-research

Warn

Audited by Snyk on Aug 25, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (medium risk: 0.30). SKILL.md describes fanning out to outsider-authored sources like Reddit threads and YouTube review transcripts (via Scavio) and using Extract on arbitrary third-party URLs, meaning user-requested product searches can ingest free text authored by outsiders without first selecting a specific trusted item.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Aug 25, 2026, 05:51 PM

Issues

1

Security Audit — snyk — product-deep-research