OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail3 providerslatest audit Mar 14, 2026
Independent checks from skills.sh's audit partners.
This skill automates Git and GitHub PR workflows but contains a high-risk instruction directing the agent to execute a temporary file containing the PR description. Since this description is derived from codebase changes (diffs), it creates a direct vector for arbitrary command execution. Additionally, the skill permits the agent to install unverified dependencies and suppresses all interactive safety prompts.
Detected behaviors
No alerts
No issues