adversarial-code-loop

• Outcome: Review
• Latest audit: Aug 3, 2026 · 8:35 PM UTC
• Version: 0.1.0

Overview

This is a disclosed code-automation skill, but it asks for broad local control and includes guidance for bypassing safety and secret-protection controls.

Review this skill before installing. Use it only in a disposable or clearly bounded worktree, prefer --no-merge until you inspect the branch, avoid the documented dangerous sandbox/approval bypass examples unless the environment is isolated, and do not copy local secrets or bypass GitHub secret scanning without an approved security exception.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (65)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_repo(name: str, cwd: str, test_cmd: str, timeout: float) -> dict:
    start = time.monotonic()
    try:
        proc = subprocess.Popen(
            ["/bin/bash", "-c", test_cmd],
            cwd=cwd,
            stdout=subprocess.PIPE,

• Confidence: 96% confidence
• Finding: proc = subprocess.Popen( ["/bin/bash", "-c", test_cmd], cwd=cwd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, start_new_session

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

spec = tmp_path / "spec.md"
    spec.write_text(spec_body)

    proc = subprocess.run(
        [sys.executable, str(_LOOP),
         "--spec", str(spec), "--workdir", str(workdir),
         "--feature", "cgtest", "--no-merge", "--max-loops", "1",

• Confidence: 84% confidence
• Finding: proc = subprocess.run( [sys.executable, str(_LOOP), "--spec", str(spec), "--workdir", str(workdir), "--feature", "cgtest", "--no-merge", "--max-loops", "1", "--d

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env={**_env(), **env},
    )

    proc = subprocess.run(
        [sys.executable, str(_LOOP),
         "--spec", str(spec), "--workdir", str(workdir),
         "--feature", "snapshot", "--no-merge", "--max-loops", "1",

• Confidence: 84% confidence
• Finding: proc = subprocess.run( [sys.executable, str(_LOOP), "--spec", str(spec), "--workdir", str(workdir), "--feature", "snapshot", "--no-merge", "--max-loops", "1", "-

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

spec = tmp_path / "spec.md"
    spec.write_text(_SPEC)

    proc = subprocess.run(
        [sys.executable, str(_LOOP),
         "--spec", str(spec), "--workdir", str(workdir),
         "--feature", "igtest", "--no-merge", "--max-loops", "1",

• Confidence: 80% confidence
• Finding: proc = subprocess.run( [sys.executable, str(_LOOP), "--spec", str(spec), "--workdir", str(workdir), "--feature", "igtest", "--no-merge", "--max-loops", "1", "--d

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

spec = tmp_path / "spec.md"
    spec.write_text(_SPEC)

    proc = subprocess.run(
        [sys.executable, str(_LOOP),
         "--spec", str(spec), "--workdir", str(workdir),
         "--feature", "igtest-default", "--no-merge", "--max-loops", "1",

• Confidence: 77% confidence
• Finding: proc = subprocess.run( [sys.executable, str(_LOOP), "--spec", str(spec), "--workdir", str(workdir), "--feature", "igtest-default", "--no-merge", "--max-loops", "1",

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill clearly documents capabilities to read environment files, modify files, and execute shell/git commands, yet it declares no permissions. This mismatch undermines any permission-review or least-privilege controls and can cause operators or orchestration layers to trust a skill with broader powers than disclosed.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill instructs operators to extract a DeepSeek API key from ~/.hermes/.env and re-materialize it into another tool's auth file. That expands secret exposure beyond the skill's core code-loop purpose and normalizes handling credentials in plaintext across multiple locations.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The document frames the workflow as a simple alternative for small refactors, but the example command grants full filesystem access and disables approvals and sandboxing. That mismatch can cause users to underestimate the risk and run a highly privileged agent in situations where they would otherwise apply stronger safeguards.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documented command runs Codex with `--dangerously-bypass-approvals-and-sandbox` and `--sandbox danger-full-access`, giving the agent unrestricted ability to modify files and execute actions without review. In the context of a code-review skill, this is unnecessarily powerful and increases the blast radius of prompt injection, malicious specs, or unintended agent behavior.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documentation explicitly instructs operators to launch the model with a dangerous permission-skipping flag and then script keystrokes to trust and bypass safety dialogs. That weakens built-in security controls and normalizes running the reviewer in a less restricted mode than the skill's review-orchestration purpose requires, increasing the chance of unauthorized command execution or unsafe tool use.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This document explicitly instructs users how to bypass GitHub push-protection secret scanning, a repository security control designed to prevent accidental or unsafe secret exposure. Even though it frames the use case as 'public by design' credentials, it normalizes and operationalizes disabling a security safeguard in a skill whose stated purpose is unrelated to secret-management policy exceptions, which increases the chance of misuse for real secrets.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The sample code obtains a GitHub auth token from the local CLI and uses it to call the push-protection bypass API, directly enabling users to suppress a security control guarding against secret leaks. This is dangerous because it turns a manual security exception into a scripted workflow that can be reused to push actual sensitive credentials, and it encourages token use for a capability unrelated to the skill's branch-orchestration purpose.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The 'cleaner approach' is not actually removing embedded credentials; it documents a way to restructure literals so the scanner no longer detects them while the secret remains in code. That is effectively evasion of a detection control, and it can mislead users into thinking the repository is safe when a credential is still hardcoded and distributable.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The document materially expands the skill from a git-native adversarial review loop into a broader automation system that inspects provider quotas, reads local credential-backed auth state, persists execution state, and resumes work via cron. That expansion increases privilege and operational scope beyond the stated purpose, creating opportunities for unintended secret access, background execution, and harder-to-audit autonomous behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill describes accessing local OAuth/API credential stores and calling provider-specific usage endpoints that are not clearly necessary for the core code-review loop. Even if intended for quota awareness, instructing an agent to inspect credential files broadens data access to sensitive tokens and can normalize secret handling without adequate boundaries.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill advertises isolated per-loop branch execution, but this guidance states that even rejected steps still write code onto the worktree and loop branch, breaking the expected isolation boundary. In an adversarial code-generation workflow, that mismatch is dangerous because users may trust rejection as a safety gate while unreviewed or malicious changes persist in repository state and can later be committed accidentally.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The document embeds a critical instruction that forbids file writes, then later states that the workflow writes the generated code to disk. This mismatch can cause an agent or operator to rely on a non-writing safety constraint that is not actually preserved end-to-end, increasing the chance of unintended file modification.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill advertises isolated per-loop branch operation, but this code can optionally execute an integration gate across sibling repositories in a shared workspace. That expands the trust boundary beyond the target repo and can run manifest-defined test commands against adjacent repos, creating an unexpected cross-repository execution surface and possible unintended mutation or data exposure.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This section adds multi-repository workspace testing capability that is not aligned with the stated purpose of a single loop branch orchestrator. In a security context, undeclared expansion from one repository to sibling repositories increases blast radius: a crafted manifest or workspace layout could cause execution of commands in unintended projects, violating operator expectations about isolation.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The integration gate intentionally reads `test_cmd` from a manifest and executes it via bash, so any actor who can influence the manifest or repo metadata can achieve arbitrary command execution. Because this runner is specifically for cross-repo testing of adversarial-* skill repos, the surrounding context makes this more dangerous, not less, since the executed inputs should be treated as hostile.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This mock explicitly modifies the on-disk spec to remove directive blocks so later validation can pass without enforcing requirements. Even though it is in a test path, it models and legitimizes a contract-gate bypass technique that undermines the integrity of the BUILD/REVIEW/FIX/VERIFY workflow if similar behavior is possible in real agents or reused test harnesses.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The comments document deliberate evasion of the contract gate by stripping directives to achieve vacuous approval, which directly conflicts with the skill's claimed verification purpose. This is dangerous because it signals intentional design or acceptance of integrity-breaking behavior, increasing the likelihood that verification outcomes can be manipulated rather than trusted.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The plan explicitly documents automatic repository-modifying actions such as staging, committing, stashing, branch creation, and merging, but does not require an explicit user warning or confirmation before mutating repository state. In a developer automation skill, this can lead to unintended code history changes, hidden workspace alterations, or accidental merges in sensitive repositories, especially when run in the wrong directory.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The plan includes execution of user-specified commands such as build/test commands through subprocesses without documented safety controls. Because this skill is designed to operate on local developer worktrees, unsafe command execution can result in arbitrary code execution, data destruction, credential exposure, or unintended network access if untrusted specs, flags, or environment values are passed through unchecked.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The installation command pipes a remote script directly into bash with no integrity verification or warning. If the remote content or transport path is compromised, users execute arbitrary code immediately on their system.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/quota-aware-orchestration.md:153