OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn3 providerslatest audit Sep 6, 2026
Independent checks from skills.sh's audit partners.
The skill orchestrates Three.js game development and includes automated checks for required API keys (Tripo, Gemini, ElevenLabs). It uses shell scripts to probe user configuration files and audit generated reports. The primary security concern is the automated probing of sensitive shell profile files (~/.bashrc, ~/.zshrc) to detect credentials, which involves dynamic execution of code within those files. Additionally, the skill's ability to process external files while maintaining shell execution capabilities presents a risk for indirect prompt injection.
Detected behaviors
No alerts
No issues