yashandb-c
Warn
Audited by Snyk on Mar 23, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's required installation workflow explicitly fetches and parses releases from public GitHub Releases (https://github.com/yashan-technologies/yashandb-client/releases) and external download URLs (e.g., https://linked.yashandb.com) using gh/wget/curl, so the agent reads and acts on untrusted third‑party web content to determine what to download and install.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill explicitly downloads and installs native binaries at runtime from GitHub Releases (https://github.com/yashan-technologies/yashandb-client/releases and the releases/download URLs) and the vendor site (e.g. https://linked.yashandb.com/upload1010/yashandb-client-23.4.1.102-linux-x86_64.tar.gz), which fetches remote executable code that the skill requires and that will be executed on the host.
Issues (2)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata