OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit Sep 14, 2026
Independent checks from skills.sh's audit partners.
The skill instructs the agent to read sensitive configuration files, including .env files, to extract live values for inclusion in planning documents. This behavior risks exposing API keys and other credentials. Additionally, the skill processes various project files and external documentation as instructions, which creates a surface for indirect prompt injection attacks.
Detected behaviors
No alerts
No issues
Score: 93/100 · 2 sections analyzed