Phoenix Code Review

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:22 PM UTC
• Version: 1.2.1

Overview

This Phoenix review skill is mostly documentation-only, but it requires an unbundled sibling skill that can influence the agent’s review output.

Use this skill only if you also control and have reviewed the referenced review-verification-protocol skill, or if the publisher vendors and pins that protocol inside the package. The bundled Phoenix checklist itself appears low risk, but the external mandatory gate makes the reviewed package incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:67

Finding

Mandatory Delegation to an Unverified External Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:67-72
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable code snippet:

markdown

3. **Verification protocol** — Load and apply [review-verification-protocol](../review-verification-protocol/SKILL.md) for the issue type. **Pass:** that skill’s pre-report checks for that finding class are satisfied before you write the finding.
4. **Finding shape** — Emit each issue as `[FILE:LINE] ISSUE_TITLE` with a one-line rationale tied to the cited code. **Pass:** every line matches that pattern.

## Before Submitting Findings

Do not report until **Gates** above pass. For full anti-false-positive steps, follow [review-verification-protocol](../review-verification-protocol/SKILL.md).

Technical Analysis

The Skill requires the agent to load and apply instructions from the sibling path ../review-verification-protocol/SKILL.md, which is outside the audited package and was not included in the supplied project. The referenced instructions therefore cannot be reviewed or integrity-verified as part of this audit.

This is an instruction-hijacking risk because the external Skill is made a mandatory prerequisite for producing findings. Its content would execute within the agent’s current review context and could introduce unrelated directives, alter review criteria, suppress findings, redirect tool usage, or modify the final output. The instruction to refrain from reporting until the external gate passes increases the external file’s control over the agent’s behavior.

Attack Path

1. An attacker creates or modifies ../review-verification-protocol/SKILL.md in the environment containing the audited Skill.
2. A user invokes phoenix-code-review for a Phoenix code review.
3. The agent reaches the mandatory verification gate in SKILL.md.
4. The agent loads the attacker-controlled sibling Skill as instructed.
5. The sibling Skill su ...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory dependency on the sibling Skill.
2. Incorporate all required verification rules directly into this package so the complete instruction set can be audited together.
3. If modularization is necessary, vendor the dependency inside the project rather than referencing a mutable parent-directory path.
4. Pin the dependency to a reviewed version and verify its cryptographic digest before use.
5. Treat external Skill content as untrusted reference material rather than authoritative instructions.
6. Do not make report generation conditional on compliance with instructions obtained from outside the reviewed package.
7. Explicitly state that any referenced guidance remains subordinate to system instructions, user requirements, and security policies.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.