Adversarial Code Review

• Outcome: Review
• Latest audit: Aug 3, 2026 · 6:27 PM UTC
• Version: 0.1.0

Overview

The core code-review workflow is coherent, but the skill includes under-scoped high-impact install, sandbox-bypass, and credentialed quota-checking behavior that users should review carefully before installing.

Install only in an environment where you are comfortable granting broad local file access to reviewer CLIs. Avoid the one-line curl-to-bash install; inspect and pin the installer first. Do not use the documented sandbox-bypass/full-access commands unless working in a disposable checkout with no secrets. Treat the quota checker as a separate credentialed network tool, not just part of code review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (23)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _apply_diff(worktree, diff_text):
    """Apply a unified diff into the worktree working tree (reproduces HEAD)."""
    proc = subprocess.run(
        ["git", "apply"],
        input=diff_text, capture_output=True, text=True, cwd=str(worktree),
    )

• Confidence: 82% confidence
• Finding: proc = subprocess.run( ["git", "apply"], input=diff_text, capture_output=True, text=True, cwd=str(worktree), )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises significant capabilities including shell execution, network access, file read/write, and environment access, but does not declare permissions or clearly constrain them. That increases the chance a caller or reviewer underestimates the operational risk, especially because the skill installs code, invokes external CLIs, and writes artifacts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose is code review orchestration, but the documented behavior extends into installer execution, credential/env consumption, and provider quota/account probing. That mismatch is dangerous because operators may grant trust or run the skill in environments containing secrets, not realizing it may access credentials, local plugin paths, or external provider endpoints.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly recommends running reviewer commands with `--dangerously-bypass-approvals-and-sandbox` and `--yolo`, which disable normal execution safeguards for a task described as code review. Because the workflow also tells the reviewer to explore repositories with shell tools, a malicious or booby-trapped project could induce unsafe command execution or broader filesystem access, making the review process materially riskier than necessary.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The document materially expands the skill from code-review assistance into fix-plan generation and orchestration of multiple model outputs, which is outside the declared skill scope. Scope drift is dangerous because it can cause users or agents to perform higher-risk actions than expected, reducing informed consent and weakening policy controls tied to the manifest.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The instructions tell the agent to invoke external model CLIs and explicitly use `--sandbox danger-full-access`, granting broad filesystem and environment access not necessary for generating a plan. In a security-analysis context, this is especially risky because adversarial content could be funneled into powerful subprocesses that can read secrets, modify files, or execute unintended actions.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script adds credentialed quota/balance checks for multiple external AI providers, which is unrelated to the advertised adversarial code-review skill. In this skill context, that mismatch is dangerous because it expands capabilities to access local tokens and contact third-party services, creating unnecessary credential exposure and covert data-flow risk under the guise of a code-review tool.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script is designed to locate provider credentials and use them to query account usage or balances, including undocumented endpoints. For a code-review skill, this is an unjustified credential-access and external-transmission capability; if invoked, it can reveal account metadata to providers and normalize hidden use of locally available tokens.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code prepends a home-directory plugin path influenced by HERMES_REAL_HOME to sys.path and then imports quota_api, causing execution of whatever module is present there. That creates a code-execution trust boundary on user- or environment-controlled filesystem content, which can be abused to run arbitrary Python whenever quota checks are triggered.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation recommends piping a remote script directly into bash without any verification or warning. If the remote content, transport path, repository, or upstream account is compromised, users may execute attacker-controlled code immediately on their machine.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The file presents dangerous bypass commands as normal operating guidance without a prominent warning that they disable core safety controls. In an adversarial code-review skill, this context makes the issue more dangerous, because the input repositories are explicitly untrusted and may contain content intended to manipulate or exploit the reviewing agent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown presents a dangerous command as a normal step without warning about filesystem modification, credential exposure, or other host-side effects. Users may copy-paste it directly, leading to unsafe execution under the mistaken belief that it is routine and low-risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: When `--deep-research` is enabled, the code sends the full review input to an external provider. In a code-review tool, that input may include proprietary source, secrets in diffs, or internal file contents, and the transfer is only implied by CLI help rather than strongly disclosed at the transmission point or gated by content redaction.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Reviewer phases are designed to send project content to provider commands, which is functionally necessary for this skill, but it still creates a real confidentiality risk. In this skill context, the danger is elevated because the tool can ingest whole files, project directories, and diffs, then forward them to external model wrappers selected by config or environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer explicitly recommends bootstrapping via a curl-to-bash pipeline, which executes remote code immediately without giving the user an opportunity to inspect the script or verify its integrity. If the GitHub source, account, branch, or network path is compromised, arbitrary shell commands would run on the user's machine during installation.

External Transmission

Medium

• Category: Data Exfiltration

Content

- **Key**: `GLM_API_KEY` env var, falling back to `ZHIPU_API_KEY`
- **Endpoints** (tried in order):
  - `https://api.z.ai/api/monitor/usage/quota/limit`
  - `https://open.bigmodel.cn/api/monitor/usage/quota/limit`
- **Status**: Undocumented, community-derived coding-plan monitoring endpoints;
  neither is a supported public quota API contract.

• Confidence: 91% confidence
• Finding: https://api.z.ai/

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoints, credentials, status, and privacy notes (full details in
``references/ai-quota-apis.md``):

* Claude: ``https://api.anthropic.com/api/oauth/usage``; OAuth token from
  ``~/.claude/.credentials.json``; first-party but undocumented and
  community-discovered; sends the OAuth token and exposes account usage.
* Codex: ``https://chatgpt.com/backend-api/wham/usage``; OAuth token from

• Confidence: 92% confidence
• Finding: https://api.anthropic.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

``/api/monitor/usage/quota/limit``; key from ``GLM_API_KEY`` or
  ``ZHIPU_API_KEY``; undocumented/community endpoints; fallback can send the
  same credential and account-usage request to both Z.AI/Zhipu hosts.
* DeepSeek: official ``https://api.deepseek.com/user/balance``; key from
  ``DEEPSEEK_API_KEY``; sends the key and exposes the account balance.

Every check discloses the caller's IP, timing, and account association to the

• Confidence: 92% confidence
• Finding: https://api.deepseek.com/

Credential Access

High

• Category: Privilege Escalation

Content

``references/ai-quota-apis.md``):

* Claude: ``https://api.anthropic.com/api/oauth/usage``; OAuth token from
  ``~/.claude/.credentials.json``; first-party but undocumented and
  community-discovered; sends the OAuth token and exposes account usage.
* Codex: ``https://chatgpt.com/backend-api/wham/usage``; OAuth token from
  ``~/.codex/auth.json``; first-party/official service but not a documented

• Confidence: 97% confidence
• Finding: credentials.json

External Script Fetching

Low

• Category: Supply Chain

Content

Requires the `adversarial-common` sibling repo (shared engine). One-line install:

curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-code-review/main/scripts/install.sh | bash

or, from an existing checkout:

• Confidence: 97% confidence
• Finding: curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-code-review/main/scripts/install.sh | bash

External Script Fetching

Low

• Category: Supply Chain

Content

#!/usr/bin/env bash
# Install adversarial-code-review with its single dependency: adversarial-common (sibling layout).
# Usage:
#   Bootstrap (from anywhere):  curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-code-review/main/scripts/install.sh | bash
#   From a checkout:            bash scripts/install.sh [TARGET_DIR]
# Target layout (siblings required):
#   <TARGET>/adversarial-code-review            (this skill)

• Confidence: 91% confidence
• Finding: curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-code-review/main/scripts/install.sh | bash

Chaining Abuse

High

• Category: Tool Misuse

Content

Requires the `adversarial-common` sibling repo (shared engine). One-line install:

curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-code-review/main/scripts/install.sh | bash

or, from an existing checkout:

• Confidence: 99% confidence
• Finding: | bash

Chaining Abuse

High

• Category: Tool Misuse

Content

#!/usr/bin/env bash
# Install adversarial-code-review with its single dependency: adversarial-common (sibling layout).
# Usage:
#   Bootstrap (from anywhere):  curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-code-review/main/scripts/install.sh | bash
#   From a checkout:            bash scripts/install.sh [TARGET_DIR]
# Target layout (siblings required):
#   <TARGET>/adversarial-code-review            (this skill)

• Confidence: 97% confidence
• Finding: | bash

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_quota_cli.py:23