OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Pass4 providerslatest audit Sep 14, 2026
Independent checks from skills.sh's audit partners.
The skill provides a robust authorization and role-based access control system for the Caffeine AI platform. It handles user profiles and verified identity attributes (such as email and name) from providers like Google and Microsoft. The analysis identified a minor surface for indirect prompt injection where external identity data is ingested into the system state without explicit sanitization in the documentation examples. This is a common pattern in authentication skills but warrants awareness for downstream data handling. No malicious code or critical vulnerabilities were found.
Detected behaviors
No alerts
No issues
Score: 93/100 · 2 sections analyzed