Senior Code Reviewer

• Outcome: Pass
• Latest audit: May 28, 2026, 1:54 PM
• Version:
  0.1.0

Overview

This is a local code-review helper that reads the repository you choose and can write reports, with no evidence of hidden networking, persistence, or destructive behavior.

Install only if you are comfortable running local Python code-review scripts against selected project folders. Point it at the specific repository or directory you intend to review, avoid broad private directories, and review generated reports before sharing because they may include file paths, code findings, or sensitive project details.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs use of local scripts that read repositories, generate outputs, and invoke Python from the shell, but the metadata does not declare corresponding permissions. This creates a capability/permission mismatch that can bypass user expectations and platform controls, especially because the skill operates on arbitrary repository paths and can write report artifacts.

VirusTotal

66/66 vendors flagged this skill as clean.