OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill is highly vulnerable to Indirect Prompt Injection because it fetches untrusted community content (crate descriptions, changelogs) and processes it while having access to powerful tools like Bash and Task. It also performs path traversal to read files outside its immediate directory.
Detected behaviors
No alerts
No issues
1/1 file flagged
Score: 93/100 · 2 sections analyzed