Add SafeSkill security badge (20/100 — Blocked)

[OyaAIProd]

🔴 SafeSkill Security Scan Results

Metric	Value
Overall Score	20/100 (Blocked)
Code Score	71/100
Content Score	69/100
Findings	1363 findings detected (87 critical)
Taint Flows	16
Files Scanned	274
Scan Duration	24.4s

Note: This package is an MCP server — child_process, filesystem, and environment access are expected capabilities for tool servers and are excluded from scoring and top findings.

Top Findings

• 🔴 critical: Detected instruction-override attempt: "ignore previous instructions" (shared/llm.ts:16:22)
• 🟠 high: Dynamic import with non-literal argument (shared/llm.ts:27)
• 🟠 high: Dynamic import with non-literal argument (apis/network-path-infer/index.ts:203)
• 🟠 high: Dependency "@x402/core" is suspiciously similar to popular package "cors" (possible typosquatting) (package.json:0)
• 🟠 high: Makes HTTP request via fetch() (apis/performance-security-compliance-report/analyzer.ts:484)

View full report on SafeSkill

---

About SafeSkill

SafeSkill is a free, open-source security scanner for AI tools, MCP servers, and Claude Code skills. We scan for code exploits, prompt injection, and data exfiltration risks.

False positive? We take accuracy seriously. If any finding above is incorrect, please open an issue and we will fix it immediately.

• GitHub | Website | Docs
• Built by Oya.ai -- AI Employees Builder