pr-review-expert

• Analyzed: May 11, 2026, 5:57 AM
• Findings: 1
• Version: 1.0.0
• Hash: dcdfece8f03ba3e2ca2f7d19ce79d33bd489040269520d5173277d1fc6508651
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a comprehensive framework for PR reviews but includes high-risk instructions such as executing local tests (`npm test`, `pytest`) on untrusted code and utilizing sensitive API tokens (`JIRA_API_TOKEN`, `LINEAR_API_KEY`) via shell commands in SKILL.md. While these capabilities are aligned with the stated purpose, the inherent risk of Remote Code Execution (RCE) from malicious pull requests and the handling of secrets in a shell environment warrant a suspicious classification.