google-sheets
Warn
Audited by Snyk on Aug 7, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). SKILL.md enumerates “read or find data inside a spreadsheet” tools (e.g., lookupRow/findRows/listRows/getValues), and at runtime these tools directly ingest outsider-provided user inputs (spreadsheet URL/id, worksheet, ranges, and match values) and fetch corresponding cell text via the Google Sheets API, which is free-form content authored in the spreadsheet.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata