OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit Mar 18, 2026
Independent checks from skills.sh's audit partners.
The skill packages and uploads local project files to an external server without excluding sensitive files like environment variables (.env), which can result in the accidental exfiltration of secrets and credentials.
Detected behaviors
No alerts
No issues
3/3 files flagged