OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill allows a remote browser agent to execute arbitrary tasks based on unvalidated natural language input, creating a high risk of prompt injection. It also stores sensitive API keys in plaintext on the local filesystem.
Detected behaviors
No alerts
No issues
2/2 files flagged
Score: 93/100 · 2 sections analyzed