OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill instructs users to connect to and provide sensitive credentials to several domains (tradingviewapi.com) that have been blacklisted by security scanners as malicious. This setup poses a high risk of credential theft and malicious remote control of the agent via an untrusted MCP server.
Detected behaviors
No alerts
No issues
4/30 files flagged
Score: 93/100 · 2 sections analyzed