skills/tinh2/skills-hub-registry/registry-sync/Snyk

registry-sync

Fail

Audited by Snyk on Mar 23, 2026

Risk Level: CRITICAL

Full Analysis

CRITICAL E004: Prompt injection detected in skill instructions.

Potential prompt injection detected (high risk: 0.70). The prompt includes a "SELF-EVOLUTION TELEMETRY" section that instructs the agent to look for a project memory directory and append execution metadata to ~/.claude/projects/skill-telemetry.md — an action that is outside the stated registry validation/fix purpose and introduces hidden/persistent telemetry behavior.

Issues (1)

E004

CRITICAL

Prompt injection detected in skill instructions.

Audit Metadata

Risk Level

CRITICAL

Analyzed

Mar 23, 2026, 11:04 AM

Issues

1

Security Audit — snyk — registry-sync