OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Pass3 providerslatest audit Apr 23, 2026
Independent checks from skills.sh's audit partners.
The skill facilitates the creation of Pull Requests and includes a step for local verification by running project-specific build and test commands. While functional for development, it introduces a risk of indirect command execution if the agent is used on a repository containing malicious configuration files (e.g., scripts in package.json or Makefile), as it lacks sanitization for the commands it discovers and runs.
Detected behaviors
No alerts
No issues