OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 15, 2026
Independent checks from skills.sh's audit partners.
The skill allows an agent to generate social media content and save it to the local filesystem based on user-provided inputs. A critical security gap exists because the skill lacks input validation and boundary markers, making it vulnerable to Indirect Prompt Injection and Path Traversal. A malicious user could provide a crafted event name containing directory traversal sequences to overwrite sensitive local files.
Detected behaviors
No alerts
No issues
7/7 files flagged
Score: 93/100 · 2 sections analyzed