printing-press-publish — security audits

Review recommended

Independent security partners scan this skill's files for malicious content, prompt injection and risky patterns. Verdicts below come from the skills.sh audit program; each partner links to its full report.

• Gen Agent Trust Hub

  pass

  The skill is a developer tool for publishing CLI modules to a GitHub repository. It performs extensive local command execution, interacts with GitHub via authenticated CLI tools, and installs vendor-provided Go binaries. A potential surface for indirect prompt injection exists because the skill processes untrusted local data (manifests and READMEs) to construct pull request descriptions.

  Risk: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTIONMay 18, 2026Full report

• Socket

  pass

  No alerts

  May 16, 2026Full report

• Snyk

  warn

  Risk: MEDIUM · 2 issues

  Risk: MEDIUMMay 18, 2026Full report