OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail3 providerslatest audit Aug 8, 2026
Independent checks from skills.sh's audit partners.
The skill recommends a high-risk installation method (piping a remote script to the shell) from a non-whitelisted source and features automatic local file uploads to the cloud, which could be exploited for unauthorized data exfiltration if the tool is used to target sensitive local files. It also lacks clear sanitization for user-provided prompts, creating an indirect injection surface.
Detected behaviors
1 alert: gptAnomaly
2 issues