OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn4 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill utilizes an external command-line tool (bunjang-cli) from the public NPM registry to interact with the Bunjang marketplace. This involves downloading and executing third-party code at runtime without explicit user confirmation (via npx --yes). It also processes untrusted marketplace content like item descriptions, creating a surface for indirect prompt injection.
Detected behaviors
No alerts
2 issues
Score: 93/100 · 2 sections analyzed