CtrlK
BlogDocsLog inGet started
Tessl Logo

giuseppe-trisciuoglio/developer-kit

Comprehensive developer toolkit providing reusable skills for Java/Spring Boot, TypeScript/NestJS/React/Next.js, Python, PHP, AWS CloudFormation, AI/RAG, DevOps, and more.

69

Quality

87%

Does it follow best practices?

Impact

No eval scenarios have been run

SecuritybySnyk

Risky

Do not use without reviewing

Overview
Quality
Evals
Security
Files

Security

1 medium severity finding. This skill can be installed but you should review these findings before use.

Medium

W011: Third-party content exposure detected (indirect prompt injection risk)

What this means

The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.

Why it was flagged

Third-party content exposure detected (high risk: 0.80). The skill's SKILL.md and reference files include Server Component examples that call fetch() against environment-configured external APIs (e.g., `${process.env.API_URL}` and `EXTERNAL_API_URL` in SKILL.md and references/data-fetching.md) and handle user-generated content (blog posts/comments) which are ingested at runtime and used to drive rendering, metadata, redirects, and revalidation, thus exposing the agent to untrusted third‑party content.

Report incorrect finding
Audited
Security analysis
Snyk