OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill automates GitHub issue management but contains a high-risk remote code execution pattern in its setup script by piping an unverified web script directly to bash. It also processes untrusted GitHub issue content without sanitization, creating a surface for indirect prompt injection.
Detected behaviors
No alerts
No issues
18/20 files flagged
1 finding · Score: 82/100