OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail3 providerslatest audit May 29, 2026
Independent checks from skills.sh's audit partners.
The skill facilitates desktop automation using Midscene.js but introduces a significant risk of command injection by passing unsanitized user natural language prompts directly into shell commands. It also performs remote code execution via the npm registry and captures desktop screenshots, which poses a risk of exposing sensitive information.
Detected behaviors
1 alert: gptAnomaly
1 issue