OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit Mar 18, 2026
Independent checks from skills.sh's audit partners.
This skill performs OCR by sending local image data to a third-party API. It is vulnerable to Indirect Prompt Injection from the images it processes and could be used to exfiltrate sensitive local files if the agent is manipulated into targeting non-image paths.
Detected behaviors
No alerts
No issues
1/5 files flagged