OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit Mar 18, 2026
Independent checks from skills.sh's audit partners.
The skill facilitates lead generation via web scraping but introduces several security risks. It constructs shell commands dynamically from user-provided input, which could allow for command injection. It also reads sensitive credentials from a local .env file and passes them through shell pipes, and it depends on an external NPM package from a non-pre-approved source. Furthermore, it lacks sanitization for data scraped from social media platforms, creating a surface for indirect prompt injection.
Detected behaviors
No alerts
No issues
1/2 files flagged