skills/segodnya/agents/dev-feedback/Snyk

dev-feedback

Warn

Audited by Snyk on Jul 17, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (high risk: 0.85). Outsider-authored free text from GitLab merge requests (MR descriptions and review comments/bodies) is fetched at runtime via glab api .../merge_requests/{iid}/notes and .../changes in scripts/fetch_mr_details.py, then embedded into the subagent prompt context through the subagent’s JSON result.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Jul 17, 2026, 12:31 PM

Issues

1

Security Audit — snyk — dev-feedback