OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill facilitates media processing via the Transloadit API. It relies on downloading and executing Node.js packages (@transloadit/mcp-server and @transloadit/node) at runtime using npx. Since the provider is not on the predefined trusted list, this is flagged as an unverifiable dependency risk. It also handles API credentials through environment variables.
Detected behaviors
No alerts
No issues
1/1 file flagged
Score: 93/100 · 2 sections analyzed