OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit Mar 18, 2026
Independent checks from skills.sh's audit partners.
The skill is vulnerable to indirect prompt injection because it processes untrusted git commit messages and diffs without sanitization or boundary markers. Additionally, it constructs shell commands using unvalidated variables, which poses a risk of local command injection.
Detected behaviors
No alerts
No issues
2/3 files flagged