OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 29, 2026
Independent checks from skills.sh's audit partners.
The skill performs code reviews by sending local source code diffs to external LLM services. It instructs the agent to install third-party packages and extensions from unverified sources and execute them using the '--yolo' flag, which allows remote models to execute commands locally without user confirmation. This creates a significant risk of remote code execution if the code being reviewed contains malicious patterns.
Detected behaviors
1 alert: gptAnomaly
2 issues
4/4 files flagged
Score: 93/100 · 2 sections analyzed