create-cupid

Warn

Audited by Snyk on May 3, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

  • Third-party content exposure detected (high risk: 0.90). The skill's required workflow (Step 2 "原材料导入") and tools (tools/social_parser.py, tools/wechat_parser.py, tools/qq_parser.py, tools/photo_analyzer.py and the Read tool) explicitly ingest user-supplied or public social media/chat exports and screenshots (untrusted user-generated third‑party content) and then use that content to build analyses and generate advice, so third-party content can materially influence agent actions.

Issues (1)

W011
MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata
Risk Level
MEDIUM
Analyzed
May 3, 2026, 07:27 PM
Issues
1
Security Audit — snyk — create-cupid