OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 15, 2026
Independent checks from skills.sh's audit partners.
The skill downloads content from a user-provided URL, injects it into a source code file (.tsx), and executes a render command. This pattern allows an attacker to perform code injection and achieve remote code execution (RCE) by providing a malicious URL that breaks out of the source code string literal.
Detected behaviors
1 alert: gptAnomaly
No issues
1/1 file flagged
Score: 93/100 · 2 sections analyzed