Add SafeSkill security badge (60/100 — Use with Caution)

[OyaAIProd]

🟠 SafeSkill Security Scan Results

Metric	Value
Overall Score	60/100 (Use with Caution)
Code Score	98/100
Content Score	74/100
Findings	43 findings detected (1 critical)
Taint Flows	0
Files Scanned	20
Scan Duration	4.0s

Note: This package is an MCP server — child_process, filesystem, and environment access are expected capabilities for tool servers and are excluded from scoring and top findings.

Top Findings

• 🔴 critical: Hidden text contains instruction-like payload (html-comment): "DRAFT — Wk2 ship target Tue 2026-05-12 10:00 TPE.
  Resume keyword: WK2-Q7-DROP

P..." (docs/blog/wk2-missing-description-impact.md:10)

• 🟠 high: Dynamic import with non-literal argument (src/client.ts:311)
• 🟠 high: Persona/safety hijack attempt detected (unrestricted-mode): "Without Limits" (docs/specs/security-suite-v1.1.0.md:136)
• 🟡 medium: Makes HTTP request via fetch (src/transport.ts:80)
• 🟡 medium: Makes HTTP request via fetch() (src/transport.ts:80)

View full report on SafeSkill

---

About SafeSkill

SafeSkill is a free, open-source security scanner for AI tools, MCP servers, and Claude Code skills. We scan for code exploits, prompt injection, and data exfiltration risks.

False positive? We take accuracy seriously. If any finding above is incorrect, please open an issue and we will fix it immediately.

• GitHub | Website | Docs
• Built by Oya.ai -- AI Employees Builder