Add SafeSkill security badge (72/100 — Passes with Notes)

[OyaAIProd]

⚠️ SafeSkill Security Scan Results

Metric	Value
Overall Score	72/100 (Passes with Notes)
Code Score	68/100
Content Score	77/100
Findings	1406 findings detected (142 critical)
Taint Flows	29
Files Scanned	285
Scan Duration	56.7s

Note: This package is a CLI tool — child_process, filesystem, and environment access are expected capabilities and are excluded from scoring and top findings.

Top Findings

• 🟠 high: Dynamic import with non-literal argument (mcp/api-dev/index.ts:636)
• 🟠 high: Dynamic import with non-literal argument (src/plugins/plugin-loader.ts:123)
• 🟠 high: Dynamic import with non-literal argument (src/tools/library.ts:86)
• 🟠 high: Dynamic import with non-literal argument (src/plugins/mcp-market/integration.ts:62)
• 🟠 high: Imports crypto module "crypto" (co-occurs with network access) (mcp/api-dev/index.ts:6)

View full report on SafeSkill

---

About SafeSkill

SafeSkill is a free, open-source security scanner for AI tools, MCP servers, and Claude Code skills. We scan for code exploits, prompt injection, and data exfiltration risks.

False positive? We take accuracy seriously. If any finding above is incorrect, please open an issue and we will fix it immediately.

• GitHub | Website | Docs
• Built by Oya.ai -- AI Employees Builder