OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill installs a third-party Node.js package and executes shell commands using user-provided URLs, which could lead to command injection if inputs are not properly sanitized. It also processes external web content, creating a surface for indirect prompt injection.
Detected behaviors
No alerts
No issues
1/1 file flagged
Score: 93/100 · 2 sections analyzed