Code Review Engine

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:33 PM UTC
• Version: 1.0.0

Overview

This is a code-review guidance skill with disclosed GitHub/local review workflows and no bundled executable code, though users should treat PR comment posting and scheduled review prompts as external write actions.

Install only if you want an agent to review code and, when asked, use git or GitHub CLI. Review generated comments before letting it post to PRs, and do not run the heartbeat/cron-style workflow unless the target repositories, schedule, and posting permissions are clear.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

| Check | Severity | Example |
|-------|----------|---------|
| N+1 queries | HIGH | DB call inside a loop |
| Unbounded queries | HIGH | `SELECT *` without LIMIT on user-facing endpoints |
| Missing indexes (implied) | MEDIUM | Frequent WHERE/ORDER on unindexed columns |
| Memory leaks | HIGH | Event listeners never removed, growing caches |
| Blocking main thread | HIGH | Sync I/O in async context, CPU-heavy in event loop |

• Confidence: 80% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents posting PR review comments as part of normal operation without prominently warning that this performs an external write action. Hidden or under-disclosed side effects are dangerous because users may invoke review behavior expecting analysis only, while the agent may modify external systems or expose findings publicly in a repository workflow.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest frames the skill as a reviewer, but the documentation expands it into an actor that can post comments back to GitHub. That capability crosses from passive analysis into external side effects, which can surprise users and lead to unintended writes, spam, or disclosure of sensitive review content into external systems.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The heartbeat/cron workflow authorizes autonomous scanning for open PRs and posting results, which materially broadens the skill from on-demand review to unattended external action. In an agent environment, this increases the risk of mass unsolicited actions, accidental data leakage, and misuse of repository-integrated credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cron/heartbeat section suggests autonomous review and posting without an equally explicit disclosure that this triggers recurring external actions. In agent contexts, undisclosed automation is especially risky because it can repeatedly act on many PRs using ambient credentials with little human oversight.

Description-Behavior Mismatch

Low

• Confidence: 78% confidence
• Finding: The manifest says the skill works with 'no dependencies required,' which suggests a self-contained review capability. However, the documentation later directs use of `gh pr diff`, `gh pr view`, `gh pr review`, and `git diff`, indicating practical reliance on external tooling and repository integrations for key advertised workflows like PR review and local diff review.

Static analysis

No suspicious patterns detected.