OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The Toutiao Publisher skill automates article publishing through browser simulation. It is classified as HIGH risk due to the potential for Indirect Prompt Injection; the skill ingests external Markdown content and possesses high-privilege side-effect capabilities (publishing to a public platform) without robust sanitization. Additionally, it relies on a non-standard stealth dependency ('patchright') and disables browser sandboxing.
Detected behaviors
No alerts
No issues
10/10 files flagged
Score: 93/100 · 2 sections analyzed