news-sentiment
Fail
Audited by Snyk on Sep 17, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The skill prompt instructs the agent to read an API key from a configuration file and substitute its literal value directly into a URL query parameter for a web fetch request, exposing the secret in the LLM's context and execution flow.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (low risk: 0.10). The skill fetches news articles and search results containing arbitrary third-party headlines and descriptions from NewsAPI and web search providers.
Issues (2)
W007
HIGHInsecure credential handling detected in skill instructions.
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata