OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn5 providerslatest audit Apr 21, 2026
Independent checks from skills.sh's audit partners.
The skill provides a data analysis tool using DuckDB. It includes a SQL injection vulnerability where malicious file names or Excel sheet names can execute arbitrary SQL commands. It also dynamically installs dependencies from PyPI and downloads DuckDB extensions at runtime.
Detected behaviors
No alerts
No issues
2/2 files flagged
Score: 93/100 · 2 sections analyzed