OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn3 providerslatest audit Sep 14, 2026
Independent checks from skills.sh's audit partners.
The skill allows querying GitHub pull requests and contains a command injection vulnerability due to unsafe use of eval in its core script. It also presents an indirect prompt injection surface by ingesting externally-sourced PR content.
Detected behaviors
No alerts
1 issue