OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail3 providerslatest audit May 18, 2026
Independent checks from skills.sh's audit partners.
The skill fetches and summarizes web pages into an Obsidian vault. While it contains strong defensive instructions against prompt injection from fetched content, it employs shell commands to process URLs and local metadata, creating potential vectors for command injection and indirect prompt injection.
Detected behaviors
No alerts
2 issues