Security audit

unified-review

Security checks for vulnerabilities and agentic risk

Overview

This review-orchestration skill is mostly purpose-aligned, but it automatically runs a local persistence command with review-derived text and broad triggers, which creates avoidable execution and data-retention risk.

Review this skill carefully before installing. Its review orchestration is coherent, but users should disable or require explicit confirmation for deferred backlog capture, narrow the triggers to a unique command such as `full-review`, and ensure any `scripts/deferred_capture.py` script is trusted and invoked with a safe argument-array API rather than shell interpolation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:151
Finding: Shell Command Injection Through Unescaped Review Finding Data
Content: View full analysis
" \ --source review \ --context "Review dimension: . " ``` The `` value should match the review skill that surfaced the finding (e.g. `bug-review`, `api-review`, `architecture-review`). This runs automatically after the action plan is finalised, without prompting the user. ``` ### Technical Analysis The Skill instructs the agent to interpolate finding titles, dimensions, and descriptions into a shell command. These values can be derived from content in the repository under review and therefore may be attacker-controlled. Wrapping a value in double quotes does not neutralize shell metacharacters. Shell command substitutions such as `$(command)` and backtick expressions are still evaluated inside double-quoted strings. If a malicious value is inserted verbatim into either `--title` or `--context`, the shell can execute the embedded command before `deferred_capture.py` receives its arguments. For example, a finding description containing `$(attacker_command)` could produce a command structurally equivalent to: ```bash python3 scripts/deferred_capture.py \ --title "Example finding" \ --source review \ --context "Review dimension: bug-review. $(attacker_command)" ``` The vulnerability is aggravated by the explicit instruction to perform the operation automatically without asking the user for confirmation. Exploitation requires the reviewing agent to reproduce attacker-controlled rep ...[truncated 1740 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 86% confidence
Finding: Using a trigger that conflicts with a built-in command can cause this skill to shadow or intercept user intent unexpectedly. In context, that raises the risk of an ordinary review request activating a more powerful orchestration flow that may launch sub-agents and execute local persistence steps.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes broad generic terms like review and analysis, increasing the chance this skill is invoked in situations the user did not intend. Because the skill includes post-review execution behavior, accidental invocation is more dangerous than for a purely passive skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill goes beyond analysis by directing automatic execution of a local script that persists review findings. In an agent setting, automatic command execution that writes to local state creates an integrity and privacy risk because review content may be stored without explicit user approval and the agent's scope silently expands from read/analyze to modify/persist.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that backlog capture runs automatically without prompting, but does not warn the user that review data will be persisted. Lack of disclosure and consent is risky because findings may contain sensitive architectural, security, or internal project information that should not be automatically written to disk or workflow artifacts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented workflow expands review orchestration into automatic post-review persistence, which changes the trust boundary of the skill. Even if the script itself is legitimate, automatic state-changing behavior can cause unintended data retention, repository pollution, or execution of attacker-controlled local scripts in a compromised workspace.
Content: No source excerpt is available for this finding.