OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit May 18, 2026
Independent checks from skills.sh's audit partners.
The 'forge' skill extracts knowledge from session transcripts and promotes them to a persistent learning directory. It uses standard local shell utilities and the 'ao' CLI tool for processing. The primary security risk is the indirect prompt injection surface created by processing untrusted transcript data into long-term memory.
Detected behaviors
No alerts
1 issue
2/2 files flagged
Score: 93/100 · 2 sections analyzed