OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill utilizes an unverified third-party SDK ('z-ai-web-dev-sdk') to fetch and process web content, which introduces risks of indirect prompt injection and data exposure to external services. Additionally, an automated scanner flagged a blacklisted URL ('this.ca') associated with the skill's context.
Detected behaviors
No alerts
No issues
1/3 files flagged
Score: 93/100 · 2 sections analyzed