Was checking out your repo and ran it through Trustabl. A couple of things seemed worth mentioning - the scan found 10 medium findings. One pattern that caught my eye is Skill fetching untrusted external content, and another is the TypeScript Claude SDK mutating tool lacking an idempotency key. These might be intentional, but could be worth a look.
Add Trustabl to your CI — trustabl/trustabl-action:
- name: Trustabl scan
uses: trustabl/trustabl-action@v1
Was checking out your repo and ran it through Trustabl. A couple of things seemed worth mentioning - the scan found 10 medium findings. One pattern that caught my eye is Skill fetching untrusted external content, and another is the TypeScript Claude SDK mutating tool lacking an idempotency key. These might be intentional, but could be worth a look.
Add Trustabl to your CI — trustabl/trustabl-action: