ReviewEvo

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:25 AM UTC
• Version: 0.1.1

Overview

This code-review skill is purpose-aligned and disclosed, but users should understand that it writes a local review history file that can influence later reviews.

Install only if you are comfortable with the skill reading git history and relevant repository files, then writing a local `.review-evo/learnings.md` review history. Keep `.review-evo/` out of version control unless your team intentionally wants to share it, and treat any existing learnings file as untrusted review data rather than instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:25

Finding

Untrusted Persistent Learnings Can Poison Future Agent Reviews

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-31 and 139-174
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Vulnerable code snippet:

markdown

Check if this project has been reviewed before:

ls .review-evo/learnings.md 2>/dev/null

text

**If the file exists:** Read `.review-evo/learnings.md` in full. This contains findings from prior runs. Reference these throughout the review — confirm resolved issues, track recurring patterns, and build on previous analysis. Tell the user: "I found learnings from a previous review. I'll build on those."

markdown

## Step 5 — Store Learnings

After delivering the review, persist findings for future runs.

Create the directory if it doesn't exist:

mkdir -p .review-evo

text

Write (or append to) `.review-evo/learnings.md` with the following structure:

```markdown
## Review — {YYYY-MM-DD}

### Project Profile
- Language: {detected}
- Key patterns: {conventions found}
- Active contributors: {count}

### Hotspots
{list of high-churn files with context}

### Recurring Patterns
{patterns that appeared in this and prior reviews}

### Resolved
{items from prior reviews that are no longer flagged}

### Open Risks
{current findings ranked by severity}

If the file already exists, append the new review section. Do not overwrite prior entries — the history is the value.

text

### Technical Analysis

The skill directs the agent to read `.review-evo/learnings.md` in full and use its contents throughout the review. This file is stored inside the analyzed repository and is not authenticated, schema-validated, or clearly isolated as untrusted data. A repository owner or another party able to modify the working tree can therefore insert prompt-like directives into the file.

Because the skill does not instruct the agent to ignore commands or behavioral directives found in the learnings file, 
...[truncated 1421 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly classify all content loaded from .review-evo/learnings.md as untrusted data.
• Instruct the agent never to execute or follow commands, policies, role changes, or behavioral directives contained in the file.
• Replace free-form Markdown persistence with a strict structured format containing an allowlist of fields and data types.
• Validate field lengths and content before loading prior findings.
• Add provenance metadata, such as the generating tool version, timestamp, repository identity, and commit hash.
• Refuse to trust a repository-tracked learnings file automatically; require user confirmation or store local state outside the repository.
• Separate previously generated observations from current instructions using clear data boundaries.
• Avoid copying arbitrary prior text into newly persisted entries so poisoned content is not propagated.
• Consider integrity protection or an agent-controlled storage location if prior findings must be trusted across sessions.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:112

Finding

Unvalidated Branch Name Is Interpolated into a Shell Command Template

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 112-124
Vulnerability Type: Potential command injection through unsafe command construction
Risk Level: Low

Vulnerable code snippet:

markdown

Ask the user what they want reviewed:

> What would you like me to focus on?
> **(a)** Full codebase health report
> **(b)** A specific branch or PR diff (provide branch name)
> **(c)** Current working changes (`git diff`)
> **(d)** A specific file or directory

### For option (a) — Full Health Report
Compile all findings from Step 3 into a structured report with sections: Hotspots, Risks, Conventions, Strengths, and Recommendations. Rank findings by severity (critical, warning, info).

### For option (b) — Branch/PR Review
Run `git diff main...{branch}` (or the appropriate target branch). Analyze the diff through the lens of the patterns found in Step 3. Flag deviations from conventions, new risk introductions, and missing test coverage for changed code.

Technical Analysis

The branch value is supplied by the user and inserted into the command template git diff main...{branch}. The skill provides no branch-name validation, argument quoting, end-of-options handling, or requirement to invoke Git without a shell.

If an implementation constructs a shell command by direct string interpolation, shell metacharacters in the supplied value may be interpreted as command syntax rather than as part of a Git revision. Values beginning with option syntax may also alter Git's behavior. The finding is conditional on the execution mechanism: a runner that passes arguments directly as an array without invoking a shell substantially reduces the command-injection risk.

Attack Path

1. An attacker or untrusted user selects the branch-review option.
2. The attacker supplies a crafted branch value containing shell syntax or an option-like payload.
3. The agent substitutes that value directly into `git dif ...[truncated 815 chars]

Remediation

View remediation

Remediation Suggestions

• Validate the supplied branch name before use with git check-ref-format --branch.
• Resolve and verify the revision with a safe Git invocation before generating the diff.
• Invoke Git through a process API that accepts an argument array rather than constructing a shell command string.
• Never concatenate user-controlled branch names into commands evaluated by a shell.
• Reject newline characters, shell metacharacters, and option-like values that do not pass strict ref validation.
• Use explicit end-of-options separators where supported and appropriate.
• Document a safe implementation pattern, such as passing diff and the validated revision expression as separate process arguments.
• Return a validation error rather than attempting to sanitize an invalid branch value.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to create a new directory and write or append persistent data into .review-evo/learnings.md inside the user's repository. Even though this is framed as a feature, it modifies the workspace and can leave unreviewed artifacts, pollute the repo, or accidentally influence later tooling and commits without an explicit up-front warning and consent for file writes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.