OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Aug 10, 2026
Independent checks from skills.sh's audit partners.
The skill collection provides high-quality educational content on context engineering and agent design. However, it includes an 'autonomous researcher' harness that fetches external data and executes local commands. The primary security concern is the exposure to indirect prompt injection: the system is designed to ingest untrusted content from the web and use an AI agent to analyze it and propose repository code changes, which could be manipulated by malicious instructions in the source documents.
Detected behaviors
3 alerts: gptAnomaly, gptSecurity
1 issue
75/231 files flagged
Scan incomplete