need-skills/up-to-date
MANDATORY when ANY of these appear: (1) writing/editing/refactoring code that calls any third-party SDK, API, or library method, (2) debugging ANY issue where an API call succeeds but the expected side-effect doesn't happen, (3) installing or importing external packages, (4) user reports something 'doesn't work' and the code involves an external service. This skill MUST be loaded BEFORE proposing any fix — never diagnose from memory.
73
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk)
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Third-party content exposure detected (high risk: 0.90). The SKILL.md "Mandatory Steps" requires the agent to "Fetch Real Docs" (e.g., via Browser/fetch_webpage or Context7) and references/public doc URLs in references/doc-urls.md (public sites like docs.stripe.com, platform.openai.com, etc.), so the agent will read and act on arbitrary public web documentation that can influence code and tool use.
Where we found it
resend.com
domain · 1 site
The plugin lists resend.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
9
https://resend.com/docs/api-reference/introduction
docs.sendgrid.com
domain · 1 site
The plugin lists sendgrid.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
10
https://docs.sendgrid.com/api-reference
nodemailer.com
domain · 1 site
The plugin lists nodemailer.com documentation URL in references/doc-urls.md and instructs the agent to fetch it via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
11
https://nodemailer.com/about/
twilio.com
domain · 1 site
The plugin lists twilio.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
12
https://www.twilio.com/docs/usage/api
docs.stripe.com
domain · 1 site
The plugin lists stripe.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
18
https://docs.stripe.com/api
github.com
domain · 16 sites
The plugin lists numerous GitHub repository URLs (changelogs, readmes, releases) in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
developer.paypal.com
domain · 1 site
The plugin lists paypal.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
20
https://developer.paypal.com/docs/api/overview/
platform.openai.com
domain · 1 site
The plugin lists platform.openai.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
26
https://platform.openai.com/docs/api-reference
docs.anthropic.com
domain · 1 site
The plugin lists anthropic.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
27
https://docs.anthropic.com/en/api
js.langchain.com
domain · 1 site
The plugin lists js.langchain.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
28
https://js.langchain.com/docs/
sdk.vercel.ai
domain · 1 site
The plugin lists sdk.vercel.ai documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
29
https://sdk.vercel.ai/docs
www.prisma.io
domain · 1 site
The plugin lists www.prisma.io documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
35
https://www.prisma.io/docs/reference/api-reference
orm.drizzle.team
domain · 1 site
The plugin lists orm.drizzle.team documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
36
https://orm.drizzle.team/docs/overview
mongoosejs.com
domain · 1 site
The plugin lists mongoosejs.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
37
https://mongoosejs.com/docs/api.html
supabase.com
domain · 1 site
The plugin lists supabase.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
38
https://supabase.com/docs/reference/javascript
authjs.dev
domain · 1 site
The plugin lists authjs.dev documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
44
https://authjs.dev/reference
clerk.com
domain · 1 site
The plugin lists clerk.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
45
https://clerk.com/docs/reference
firebase.google.com
domain · 1 site
The plugin lists firebase.google.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
46
https://firebase.google.com/docs/reference/admin
docs.aws.amazon.com
domain · 1 site
The plugin lists docs.aws.amazon.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
52
https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/
cloud.google.com
domain · 1 site
The plugin lists cloud.google.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
53
https://cloud.google.com/nodejs/docs/reference
learn.microsoft.com
domain · 1 site
The plugin lists learn.microsoft.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
54
https://learn.microsoft.com/en-us/javascript/api/overview/azure/
azure.microsoft.com
domain · 1 site
The plugin lists azure.microsoft.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
54
https://azure.microsoft.com/en-us/updates/
posthog.com
domain · 1 site
The plugin lists posthog.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
60
https://posthog.com/docs/libraries/js
docs.sentry.io
domain · 1 site
The plugin lists docs.sentry.io documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
61
https://docs.sentry.io/platforms/javascript/guides/nextjs/
developer.mixpanel.com
domain · 1 site
The plugin lists developer.mixpanel.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
62
https://developer.mixpanel.com/docs
nextjs.org
domain · 1 site
The plugin lists nextjs.org documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
68
https://nextjs.org/docs
react.dev
domain · 1 site
The plugin lists react.dev documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
69
https://react.dev/reference/react
expressjs.com
domain · 1 site
The plugin lists expressjs.com documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
70
https://expressjs.com/en/4x/api.html
fastify.dev
domain · 1 site
The plugin lists fastify.dev documentation URLs in references/doc-urls.md and instructs the agent to fetch them via fetch_webpage/Browser to verify API contracts.
references/doc-urls.md
71
https://fastify.dev/docs/latest/Reference/
- Audited
- Security analysis