OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill contains a script (convert.js) with hardcoded absolute file paths that target specific local user directories. This presents a data exposure risk and is a significant security concern for shared scripts. Additionally, the skill processes third-party content from WeChat, making it susceptible to indirect prompt injection.
Detected behaviors
No alerts
No issues
8/8 files flagged
Score: 93/100 · 2 sections analyzed