OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill provides a coding agent persona with hooks for task logging and project linting. It contains a shell command injection vulnerability in the pre-hook where the task description is echoed without sanitization, and it runs potentially untrusted scripts via npm in the post-hook.
Detected behaviors
No alerts
No issues
1 file scanned · No issues
Score: 93/100 · 2 sections analyzed