T09 · Insecure Skill Coding Practices
Error
- Location
modules/insight-generation.md:19- Finding
PR-Controlled Review Data Is Interpolated into Executable Python Source
- Content
View full analysis
- Remediation
View remediation
Security audit
pr-review
Security checks for vulnerabilities and agentic risk
Overview
This PR-review skill is mostly purpose-aligned, but it includes broad triggers, automatic persistence, and an unsafe bundled workflow that can publish review findings externally.
Review this skill before installing. It is suitable only if you are comfortable with PR review data being written to local/project memory and potentially posted to GitHub surfaces. Disable or remove automatic knowledge capture and the Discussion-posting module unless you explicitly want those behaviors, and avoid using it on private or security-sensitive PRs until the unsafe Python command and `/tmp` handling are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
other
Warning
- Location
modules/insight-generation.md:9- Finding
Review Evidence Is Published to GitHub Discussions Without an Explicit Consent or Redaction Gate
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
modules/version-validation.md:75- Finding
Predictable Shared Temporary Files Allow Symlink Overwrites and Cross-Run Data Contamination
- Content
View full analysis
/tmp/marketplace_versions.txt # For each actual plugin for plugin_dir in plugins/*/; do PLUGIN_NAME=$(basename "$plugin_dir") ACTUAL_VERSION=$(jq -r '.version' "$plugin_dir/.claude-plugin/plugin.json" 2>/dev/null || echo "MISSING") echo "$PLUGIN_NAME:$ACTUAL_VERSION" >> /tmp/actual_versions.txt done ``` ```bash # Cross-reference versions while IFS=: read -r name marketplace_version; do actual_version=$(grep "^$name:" /tmp/actual_versions.txt | cut -d: -f2) if [[ "$marketplace_version" != "$actual_version" ]]; then # BLOCKING ISSUE FOUND echo "[B-VERSION] Version mismatch for $name: marketplace=$marketplace_version, actual=$actual_version" fi done < /tmp/marketplace_versions.txt ``` ### Technical Analysis The validation procedure uses fixed filenames in the shared `/tmp` directory: - `/tmp/marketplace_versions.txt` - `/tmp/actual_versions.txt` Shell redirection follows symbolic links. A local attacker able to create these paths before the review can point them at another file writable by the review account. The first redirection truncates its target, while the second repeatedly appends to its target. The actual-version file is also never securely created or truncated before use. Therefore, stale data from an earlier review or data written by a concurrent review can affect the current validation. Fixed names additionally permit another local process to modify the files between creation and consumption. ### Attack Path 1. A local attacker predicts the fixed temporary filename. 2. The attacker creates `/tmp/m ...[truncated 1157 chars]- Remediation
View remediation
"$marketplace_versions" : > "$actual_versions" ``` 3. Replace `echo` with `printf` for predictable handling: ```bash printf '%s:%s\n' "$PLUGIN_NAME" "$ACTUAL_VERSION" >> "$actual_versions" ``` 4. Quote every temporary-file variable at every use. 5. Avoid shared files entirely where practical by processing `jq` output in memory or through a single pipeline. 6. Ensure concurrent reviews have isolated temporary directories. 7. Add tests that pre-create the former paths as symlinks and verify that no external target is modified. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
text **Verification:** Run the command with `--help` flag to verify availability. **Output:** A clear statement of scope: > "This PR implements [feature X] as specified in plan.md. The requirements are: > 1. [requirement] > 2. [requirement]
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 93% confidence
- Finding
Using
reviewas a trigger can conflict with built-in commands or other skills, leading to shadowing or unintended execution path selection. Because this skill has side effects beyond simple analysis, command ambiguity can cause the wrong tool to run and perform writes or data persistence unexpectedly.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes generic terms like
pr,review,scope,github, andgitlab, which are likely to appear in many unrelated conversations. Overly broad triggers raise the chance of accidental invocation of a skill that can perform writes, comment generation, issue creation, and memory capture.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language trigger phrase
reviewing GitHub or GitLab PRsis broad and does not clearly restrict when activation should occur. In context, this is more dangerous because the skill includes side effects such as issue creation and knowledge capture, so unintended activation has meaningful consequences.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is presented as a PR review tool, but it also instructs the agent to create GitHub/GitLab issues as part of backlog triage. That is a side effect on remote systems beyond passive review, and if the skill is auto-invoked or the user does not clearly expect issue creation, it can cause unauthorized or surprising repository modifications.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The knowledge-capture phase automatically evaluates and may persist review findings into a project memory system, but that persistence behavior is not disclosed in the main description. This can leak sensitive code-review content, architectural observations, or security findings into a broader storage system without the user's informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill omits a warning that the knowledge-capture phase may automatically persist review findings to project memory. This is a transparency and consent failure around data handling, especially problematic when reviews may contain sensitive defects, architectural commentary, or security observations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This module expands a PR review workflow into publishing PR-derived findings to GitHub Discussions, which is a separate communication surface and a broader data-sharing action than reviewing or commenting on the PR itself. Because the content includes summaries, evidence, recommendations, and related files assembled from the PR analysis, it can leak internal code details or sensitive review context beyond the expected review channel.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module instructs the agent to publish findings into GitHub Discussions without a clear necessity tied to the stated PR-review purpose. That unjustified cross-system publication increases the attack surface and can create unintended disclosure, persistence, and wider audience exposure for review artifacts that would normally remain in PR-local tooling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions direct external transmission of review findings to GitHub Discussions but provide no user-facing warning or consent step. This is dangerous because users may reasonably expect PR review data to stay within the review context, while the module silently republishes potentially sensitive summaries, evidence, and file relationships to a broader external audience.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation states the user should be asked for confirmation before capture, but the CLI section says automatic capture is the default for high-scoring findings. This inconsistency can cause users to believe review data will only be persisted after approval when in practice it may be stored automatically, undermining informed consent and enabling unintended data exfiltration into the secondary knowledge store.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This module extends a PR review skill into persistent storage of review content in a separate 'project palace' knowledge store, including PR metadata, participants, file names, line numbers, categories, and connected concepts. That is a scope expansion with data-retention implications: sensitive internal review context may be copied outside the expected PR review surface, creating privacy, access-control, and unintended secondary-use risk if users did not explicitly consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The line states that knowledge capture 'triggers automatically for high-scoring findings' during
/pr-review, but it does not clearly constrain activation beyond the score threshold or give exclusion examples. In a markdown skill description, this broad automatic-trigger language can make it unclear when capture will or will not occur.- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 90% confidence
- Finding
The trigger
pris extremely short and likely to match unintended inputs, increasing accidental invocation risk. In isolation this would be minor, but in this skill it matters because invocation can lead to file writes, remote issue creation, and memory persistence workflows.- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md **A PR review validates scope compliance, not code perfection.** The goal is to validate the implementation meets its stated requirements without introducing regressions. Improvements beyond the scope belong in future PRs. ## When To Use
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description says it reviews PRs, but later defines
--localbehavior that writes review output to a local markdown file. Undisclosed filesystem writes are a capability mismatch: even if low risk, users may invoke the skill expecting analysis only and unintentionally alter the workspace.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Retroactive capture broadens the skill from live PR review into historical mining of past PR comments, which can process more repository discussion than users may expect from the trigger. While not inherently malicious, it increases the amount of data ingested and persisted, raising consent, over-collection, and accidental disclosure risks if historical reviews contain sensitive architectural or personnel context.
- Content
Static analysis
No suspicious patterns detected.