dreamina-cli
Warn
Audited by Snyk on Apr 13, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill invokes the external Dreamina CLI (via scripts/* and scripts/dreamina_wrapper.py) which fetches and returns JSON and downloadable results from Dreamina's servers—this third-party response is parsed (see SKILL.md default workflow steps 3–6, query_result.py, and dreamina_wrapper.py handling of payloads/AigcComplianceConfirmationRequired) and used to decide polling, downloads, and follow-up actions, so untrusted remote content can materially influence the agent's behavior.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata