Security audit

pr-review

Security checks across malware telemetry and agentic risk

Overview

This PR review skill is purpose-related, but it needs Review because it can post or persist sensitive review details and uses broad triggers that could invoke it unintentionally.

Install only if you are comfortable with a PR-review assistant that may use GitHub/GitLab CLIs, create backlog issues after confirmation, publish review comments, write local reports, and capture review knowledge persistently. Before use, disable or confirm knowledge capture, avoid sensitive findings in public comments or Discussions, and prefer explicit invocation rather than generic review/pr triggers.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The manifest description does not mention that `--local` mode writes review output to a local file. Hidden filesystem write behavior is less severe than network-side effects, but it still violates least surprise and can result in unintended artifact creation in repositories or workspaces.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The manifest description does not mention that `--local` mode writes review output to a local file. Hidden filesystem write behavior is less severe than network-side effects, but it still violates least surprise and can result in unintended artifact creation in repositories or workspaces.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The knowledge-capture phase stores findings into a persistent review chamber, which exceeds the narrow expectation of ephemeral PR review. Persistent storage of code-review observations can expose sensitive implementation details, architectural notes, or security findings to broader audiences or future contexts without the user realizing the retention implications.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This module expands the skill from PR review/reporting into persistent storage of review findings, participant metadata, and repository-linked knowledge in a separate 'project palace' system. That is a real security/privacy boundary change because retained data can outlive the review, be queried later, and expose sensitive architectural or personnel information that users may not expect from the skill manifest.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: Retroactive capture widens the skill's behavior from reviewing the current PR to fetching and mining historical review comments for knowledge extraction. That broadens data access scope and can pull older sensitive discussions into long-term storage without clear consent or tight scope limits.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger list contains broad terms such as `pr`, `review`, `github`, and `gitlab`, increasing the chance the skill activates in contexts where the user did not intend to launch a write-capable review workflow. Because the skill can create issues, comments, local files, and persistent knowledge entries, overbroad activation materially raises the risk of unintended side effects.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation around report generation does not front-load a warning that the skill may create external issues and write local files. Users evaluating the skill from the description may assume a passive review process and miss that invoking it can mutate project state locally and remotely.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The file provides ready-to-use commands that post review content and inline comments to GitHub via the `gh` CLI, but it does not warn that code findings, file paths, and potentially sensitive review text will be transmitted to an external service. In a PR-review skill, this can cause unintentional disclosure of proprietary or sensitive information if users assume the output stays local.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This module explicitly instructs the agent to post PR review findings to GitHub Discussions, which is an external publication channel, but it provides no warning, approval gate, or sanitization guidance for transmitting potentially sensitive repository data. PR findings, evidence, recommendations, and changed file lists can contain confidential code details, security weaknesses, internal paths, or private project context, creating a real risk of unintended data disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Automatic capture is enabled by default while the module stores PR-derived content and participant metadata, yet the skill description does not clearly communicate the privacy and retention implications. In a code-review context, findings often include security issues, internal design rationale, and reviewer identities, so silent default persistence meaningfully increases confidentiality and compliance risk.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 95% confidence
Finding: A one-token trigger like `pr` is highly ambiguous and likely to match routine conversation or unrelated requests. On a skill that includes write-capable behaviors, this creates accidental invocation risk even if the downstream actions are separately documented.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 87% confidence
Finding: Using `review` as a trigger can shadow or collide with generic built-in review commands, causing this broader skill to run where a user expected a simpler or safer review function. Because this skill includes issue creation, file writes, and persistence features, command confusion can lead to unintended state changes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.