scope-guard

• Outcome: Review
• Latest audit: Aug 26, 2026 · 1:29 PM UTC
• Version: 1.9.19

Overview

This skill is mostly a scope-control helper, but it can create GitHub issues and default-publish detailed reasoning to GitHub Discussions.

Install only if you want an opinionated process gate that can write persistent GitHub records. Before using it on private or sensitive work, require explicit approval for every GitHub issue, label, comment, or Discussion, review/redact the content first, and consider disabling default Discussion publication and blocking hooks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill's stated purpose is evaluating scope and branch size, but it expands into actions that create external GitHub issues and discussions. That creates a capability mismatch: a review/triage skill can cause publication or tracking side effects, which may leak internal plans, roadmap details, or sensitive implementation context when a user only expected local scope analysis.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Defaulting to creation of GitHub Discussions introduces an external publication channel unrelated to the minimum necessary function of anti-overengineering guidance. Because publishing is the default, an agent following the skill could disclose design rationale, backlog candidates, or project context to a broader audience without an explicit opt-in, increasing the risk of data leakage and unintended repository activity.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module materially expands the skill from internal scope evaluation into persistent external publication on GitHub, including issue creation, labeling, comments, validation, and optional queue updates. That broader behavior increases the chance of unintended data disclosure and unintended side effects in repositories, especially because the content being published includes detailed decision context that may contain internal planning information.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This section directs the agent to publish a GitHub Discussion containing full reasoning context, alternatives, trade-offs, branch names, and planning details. That creates a concrete exfiltration path for sensitive internal reasoning to an external system, and the information shared goes well beyond what is necessary to preserve a deferred work item.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: Broad triggers such as 'scope' and 'prioritization' increase the chance this skill activates in routine conversations where the user did not intend to invoke it. In this skill's context, accidental invocation is more concerning because the workflow includes mandatory issue creation and default discussion publishing, so trigger overbreadth can indirectly cause unintended side effects.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The self-invocation trigger phrase is broad enough to activate during many ordinary development conversations about branch growth, causing the skill to insert itself without a narrowly scoped user request. In an agent setting, this can lead to unintended workflow interference, repetitive nudging, or cascading invocations that pressure users into process actions they did not explicitly ask for.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Publishing is presented as the default action and the prompt uses a default-yes flow ('[Y/n]') without a clear warning that detailed reasoning will be sent to GitHub. Default-on external sharing is dangerous because users may accept it inadvertently, causing disclosure of internal analysis, roadmap information, or sensitive context without informed consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Hook: pre-pr-scope-check

Automatically runs before PR creation:
1. Check all threshold metrics
2. Warn on Yellow, block on Red (configurable)
3. Require justification for Red zone branches

• Confidence: 88% confidence
• Finding: The hook is described as automatically running before PR creation and potentially blocking on Red conditions, which gives the skill autonomous control over a development workflow gate. Even though the action is framed as process enforcement, autonomous blocking and justification requirements can be misapplied, disrupt delivery, or be abused to coerce approval flows without explicit user review at decision time.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.