consolidate

• Outcome: Review
• Latest audit: Aug 13, 2026 · 7:09 AM UTC
• Version: 0.5.3

Overview

The skill is a coherent PR-review automation workflow, but it can automatically publish GitHub reviews, request changes, edit PR descriptions, and write tracking records without consistent per-action confirmation.

Install only if you want the agent to act as an automated PR reviewer with GitHub write authority. Prefer invoking it explicitly with interactive review enabled, use it only on repositories and PRs where automated comments/reviews are acceptable, and inspect or avoid registering the included hook scripts unless you want them to block non-consolidate review comments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The skill's declared purpose is PR review consolidation, but the referenced behavior includes hidden enforcement and interception logic, blocking certain user decisions and comment-posting operations unless they contain specific provenance markers. If the skill or its topic files silently manipulate tool calls, override user intent, or gather external account/billing data unrelated to the stated task, it creates a trust-boundary violation and can lead to unauthorized workflow control, privacy leakage, or covert policy enforcement.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This skill's post stage goes beyond summarizing review results and instructs the agent to modify the remote PR description. That expands authority from reporting into changing project state, which is risky for a skill whose described purpose is consolidation/posting and could cause unintended or unauthorized edits if invoked in the wrong context.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill mandates registering deferred items into local workspace files or creating GitHub issues automatically, which materially exceeds a PR-review summary role. Because these are persistent side effects in local and remote systems, they can create unwanted tracking artifacts or leak review content into new issues without explicit user approval.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The instructions direct mutation of workspace task files such as `.ralph/fix_plan.md` and `checklist.md`, even when reviewing an external PR. This creates an unjustified local write capability that can corrupt the operator's workspace state or cross-contaminate unrelated projects, especially in cross-repo review sessions.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation phrases are broad and overlap with normal development conversation, so the skill may trigger in situations where the user did not intend to run a workflow that can read repository state, ask questions, or prepare/post review artifacts. In a review/posting skill, accidental activation is more dangerous than in a passive reference skill because it can change workflow state and influence PR communication.

Vague Triggers

High

• Confidence: 89% confidence
• Finding: Meaning-based auto-activation across any language is highly ambiguous and allows the skill to reinterpret ordinary user text as an instruction to force interactive mode across the whole workflow. That creates prompt-trigger injection risk and unreliable control flow, especially because it changes posting behavior globally and requires the caller to emit specific acknowledgements and asks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This section explicitly instructs the agent to make repository changes, commit, push, and edit PR state, but it does not require a clear user-facing disclosure that these actions mutate external state. In an agent skill, that omission is risky because users may interpret review consolidation as a read-only summarization task while the skill can transition into write actions that affect code, branches, CI, and PR metadata.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The pushback procedure includes a direct GitHub API call that publishes a reply to a PR review thread, but the skill text does not prominently disclose that it may post externally visible comments. That can cause unintended publication of agent-generated content to collaborators or the public repository context without a clear consent boundary.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill mandates posting review content in English or Korean based on repository heuristics, without confirming user preference or repository policy. This can cause unintended disclosure or policy violations by transforming generated review content and publishing it externally in a language chosen by automation rather than the operator, especially in private repositories where language may imply audience, compliance, or workflow constraints.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The documentation tells the agent to edit the PR body on GitHub without any user-facing warning or consent checkpoint. Remote content modification is a sensitive operation; absent explicit notice, users may invoke the skill expecting commentary only and unintentionally alter canonical project records.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list includes very broad phrases such as "PR review", "AI review", "review check", and "merge ready", which are likely to match ordinary conversation and invoke the skill unexpectedly. Because this skill can post comments, request reviews, and steer repository operations, accidental activation increases the chance of unintended PR actions and noisy or misleading review automation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. Are you building an Axis A option? → Don't. Proceed automatically to Step 7
3. If a "Fix actionable items" or "Whether to post the Summary" option appears = violation
5. Does the ask question text identify the subject PR (`PR #<N> (<owner>/<repo>)` + URL)? Nickname-only subject = violation
4. **Is `AskUserQuestion` actually callable in this context?** If it errors "not enabled" / you are headless (`claude -p` / Ralph) → do NOT re-pose Axis B as text. Apply the severity default (Critical → REQUEST_CHANGES, else COMMENT only — never auto-APPROVE) and continue to Step 7 (see "AskUserQuestion unavailable → deterministic Formal Review default")

| # | Don't | Do |
|---|-------|-----|

• Confidence: 85% confidence
• Finding: auto-APPROVE

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| 🔴 Critical present (≥1) | **REQUEST_CHANGES** | Critical blocks merge — an autonomous reviewer must block, not pass |
| No Critical (Important/Minor/clean) | **COMMENT only** | Post the review body without a merge-gating verdict. An autonomous reviewer must **never** self-grant APPROVE |

**Never auto-APPROVE.** APPROVE grants merge authority and is a human decision; an autonomous/headless reviewer downgrades the merge-recommendation default (which would be APPROVE in interactive mode) to **COMMENT only**. The human merges (or explicitly APPROVEs later) at their discretion.

Detection of unavailability: the `AskUserQuestion` call errors with "No such tool" / "not enabled in this context", OR the environment is headless (`claude -p` / Ralph `.ralph/` workspace). On any of these → skip the ask, compute the default from the table above, record the auto-applied event + reason in chat, and proceed to Step 7. The Summary's medium follows the auto-applied event exactly as if the user had chosen it.

• Confidence: 90% confidence
• Finding: auto-APPROVE

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Inline auto-fire policy (no runtime ask)

When inline targets exist, the single reviews API POST carries them in `comments[]` so the author sees each finding on the exact line in the GitHub UI. **This fires automatically by the policy below — do NOT ask the user at runtime.**

**Auto-fire policy** (this decides the medium — see "Medium decision" above):

• Confidence: 81% confidence
• Finding: do NOT ask the user

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|---|-------|-----|
| 1 | Post Summary as issue comment because "I'm not a requested reviewer" | If author ≠ me, Formal Review POST is mandatory. Issue comment medium reserved for self-authored PRs |
| 2 | Ask the user "Formal Review or issue comment?" for non-requested reviewer | Medium is deterministic by the table above — Formal Review POST when author ≠ me, period |
| 3 | Auto-APPROVE when Critical = 0 + Mergeable + CI pass | APPROVE is a user decision even in the auto-eligible case. Caller asks; user answers |
| 4 | Issue COMMENT event when Critical > 0 ("less confrontational") | Critical > 0 = REQUEST_CHANGES is the only honest verdict. Auto-POST REQUEST_CHANGES — do not soften to COMMENT |
| 5 | Skip Formal Review POST when APPROVE candidate ask is rejected/skipped | If user picks "Skip Formal Review", fall back to issue comment Summary (Mergeable + Skip row in main table). Do not silently abort |

• Confidence: 91% confidence
• Finding: Auto-APPROVE

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.