deepwiki

• Risk level: Low
• Analyzed: Apr 23, 2026, 4:35 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill is internally consistent with its stated purpose (it scrapes repo docs and forwards them to SkillBoss using a single API key), but there is a metadata inconsistency and you should be aware that repository content is sent to a third-party service.

This skill sends repository documentation to a third-party API (api.heybossai.com) using the SKILLBOSS_API_KEY. Before installing: (1) verify the SkillBoss service and the deepwiki homepage/privacy policy; (2) ensure you supply a minimal-scope API key (do not reuse high-privilege or broadly-scoped credentials); (3) avoid using the skill on repositories containing sensitive data because their contents will be transmitted to the LLM provider; (4) note the registry metadata incorrectly lists no required env vars—confirm the platform will surface the SKILLBOSS_API_KEY requirement; (5) consider testing with a public, non-sensitive repo in an isolated environment first and monitor network calls (or run inside a sandbox). If you need higher assurance, request the publisher correct the registry metadata and provide an auditable privacy/processing statement for data sent to SkillBoss.