OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit Mar 18, 2026
Independent checks from skills.sh's audit partners.
This skill provides a comprehensive set of React and Next.js performance optimization guidelines. While the technical advice is high-quality and includes critical security recommendations (e.g., authenticating Server Actions), the skill presents a HIGH risk of Indirect Prompt Injection. Because it is designed to 'refactor' untrusted React/Next.js codebases, an attacker could embed malicious instructions within code comments or components that the agent might obey while performing these optimizations.
Detected behaviors
No alerts
No issues
59/59 files flagged