relay-sidecar

Warn

Audited by Snyk on May 24, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

  • Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches PR diffs using the GitHub CLI (runGhPrDiff in scripts/relay-sidecar.js / resolveRunContext) and the SKILL.md says it "sends run context and PR diff text to the configured sidecar executor", and buildPrompt inserts that PR Diff into the prompt given to the opencode executor — meaning untrusted, user-generated PR content is read and can influence model/tool behavior.

Issues (1)

W011
MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata
Risk Level
MEDIUM
Analyzed
May 24, 2026, 03:00 AM
Issues
1
Security Audit — snyk — relay-sidecar