OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit Mar 18, 2026
Independent checks from skills.sh's audit partners.
The skill requires installing an external Node.js package (@apify/mcpc) and uses shell commands to extract credentials from a local .env file. It also processes untrusted data from multiple web platforms, which poses a risk of indirect prompt injection.
Detected behaviors
No alerts
No issues
1/2 files flagged