relay-sidecar
Warn
Audited by Snyk on May 24, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches PR diffs using the GitHub CLI (runGhPrDiff in scripts/relay-sidecar.js / resolveRunContext) and the SKILL.md says it "sends run context and PR diff text to the configured sidecar executor", and buildPrompt inserts that PR Diff into the prompt given to the opencode executor — meaning untrusted, user-generated PR content is read and can influence model/tool behavior.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata