OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill is flagged as CRITICAL due to the inclusion of a command that downloads and executes a shell script directly from a remote server (curl | sh). This is an unverified remote code execution pattern. Additionally, it installs several external Python packages and contains a surface for indirect prompt injection via unsanitized Airflow parameters.
Detected behaviors
No alerts
No issues
2/2 files flagged
1 finding · Score: 82/100