Review

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:23 PM UTC
• Version: 1.1.1

Overview

The skill is a legitimate review workflow, but it gives itself broad write, commit, dependency execution, and operational log access without clear user confirmation.

Install only if you are comfortable with a review skill that can edit and commit project documentation, requirements, planning files, and future-agent guidance. Prefer requiring explicit approval before any write or git commit, and run dependency installs or production log checks only in an isolated environment with scoped credentials.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:500

Finding

Persistent Modification of Agent Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:500-530
Vulnerability Type: Persistent agent instruction modification
Risk Level: Medium

Vulnerable Code

markdown

## Post-Verdict: CLAUDE.md Revision

After the verdict report, revise the project's CLAUDE.md to keep it lean and useful for future agents.

### Steps:

1. **Read CLAUDE.md** and check size: `wc -c CLAUDE.md`
2. **Add learnings from this review:**
   - New Do/Don't rules discovered during review
   - Updated commands, workflows, or architecture decisions
   - Fixed issues or gotchas worth remembering
   - Stack/dependency changes (new packages, removed deps)
3. **If over 40,000 characters — trim ruthlessly:**
   - Collapse completed phase/milestone histories into one line each
   - Remove verbose explanations — keep terse, actionable notes
   - Remove duplicate info (same thing explained in multiple sections)
   - Remove historical migration notes, old debugging context
   - Remove examples that are obvious from code or covered by skill/doc files
   - Remove outdated troubleshooting for resolved issues
4. **Verify result ≤ 40,000 characters** — if still over, cut least actionable content
5. **Write updated CLAUDE.md**, update "Last updated" date

### Priority (keep → cut):
1. **ALWAYS KEEP:** Tech stack, directory structure, Do/Don't rules, common commands, architecture decisions
2. **KEEP:** Workflow instructions, troubleshooting for active issues, key file references
3. **CONDENSE:** Phase histories (one line each), detailed examples, tool/MCP listings
4. **CUT FIRST:** Historical notes, verbose explanations, duplicated content, resolved issues

### Rules:
- Never remove Do/Don't sections — critical guardrails
- Preserve overall section structure and ordering
- Every line must earn its place: "would a future agent need this to do their job?"
- Commit the update: `git add CLAUDE.md && git commit -m "docs: revise C
...[truncated 1982 chars]

Remediation

View remediation

Remediation Suggestions

• Make the review workflow read-only by default.
• Present proposed CLAUDE.md changes as a patch in the final report rather than applying them automatically.
• Require explicit, informed user approval before editing or committing persistent agent-guidance files.
• Treat repository content as untrusted when deriving new agent rules.
• Never remove existing guidance solely because of an arbitrary character limit without human review.
• If an approved update is made, restrict it to precisely identified lines and display the complete diff before committing.
• Separate operational project documentation from files that control future agent behavior.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:166

Finding

Autonomous Modification and Commit of Project Requirements and Plans

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:166-175 and SKILL.md:544-546
Vulnerability Type: Unauthorized repository state modification
Risk Level: Medium

Vulnerable Code

markdown

**Update spec.md checkboxes.** After verifying each criterion, use Edit tool to change `- [ ]` to `- [x]` in spec.md. Leaving verified criteria unchecked causes staleness across pipeline runs — check them off as you go.

Acceptance Criteria: - [x] User can sign up with email — found in app/auth/signup/page.tsx + test - [x] Dashboard shows project list — found in app/dashboard/page.tsx - [ ] Stripe checkout works — route exists but no test coverage

text

After updating checkboxes, commit: `git add docs/plan/*/spec.md && git commit -m "docs: update spec checkboxes (verified by review)"`

markdown

**If FIX FIRST or BLOCK:**
1. Open plan.md and APPEND a new phase with fix tasks (one `- [ ] Task` per issue found)
2. Change plan.md status from `[x] Complete` to `[~] In Progress`
3. Commit: `git add docs/plan/ && git commit -m "fix: add review fix tasks"`

Technical Analysis

The Skill is described as a review and quality-gate workflow, but it goes beyond inspection by automatically changing acceptance-criteria status, altering plan status, appending tasks, staging files, and creating Git commits.

This violates least-privilege expectations for an audit operation. Review conclusions can be incorrect or can be influenced by malicious project content. Automatically converting those conclusions into committed project state may falsely record requirements as complete or inject attacker-shaped tasks into the development pipeline.

The command git add docs/plan/ stages the entire directory rather than only files deliberately modified by the review. Unrelated or attacker-prepared changes already present under that directory could therefore be included in the generated commit.

Attack Path

...[truncated 1184 chars]

Remediation

View remediation

Remediation Suggestions

• Keep the review process read-only unless the user explicitly requests repository changes.
• Report proposed checkbox and plan-status changes as a patch for human approval.
• Require separate confirmation before each Git commit.
• Stage exact approved files instead of directories or wildcard paths.
• Before staging, run git status --short and verify that no unrelated modifications will enter the commit.
• Do not treat the existence of implementation code as sufficient verification; require fresh test evidence and explicit reviewer confirmation.
• Consider placing generated remediation recommendations in the audit output rather than modifying authoritative specifications or plans.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:54

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:54 and SKILL.md:559
Vulnerability Type: Unsafe dependency resolution and execution
Risk Level: High

Vulnerable Code

markdown

- Next.js → `npm run build`, `npm test`, `npx next lint`

markdown

### Tests won't run
**Cause:** Missing dependencies or test config.
**Fix:** Run `npm install` / `uv sync`, check test config exists (jest.config, pytest.ini).

Technical Analysis

The Skill permits dependency installation through npm install or uv sync without requiring frozen lockfiles, source validation, or lifecycle-script restrictions. It also invokes npx next lint without requiring that the executable already exist in the project.

Depending on the package-manager version and environment, npx can resolve and download a missing package. Package installation may execute lifecycle scripts with the same permissions as the auditing agent. A crafted manifest, lockfile, package name, package source, or dependency-resolution environment could therefore cause unreviewed third-party code to execute during what should be a verification operation.

The instructions do not require package integrity checks, trusted registry configuration, offline execution, or review of manifest changes before installation.

Attack Path

1. An attacker supplies or modifies a project manifest, lockfile, package source, or expected executable name.
2. The audit encounters missing dependencies or a missing local next executable.
3. Following the Skill, the agent runs npm install, uv sync, or npx next lint.
4. The package manager resolves packages from an unsafe or attacker-influenced source.
5. A malicious package executes through an installation lifecycle script, build hook, plugin, or CLI entry point.
6. The package code runs with the auditing agent's filesystem, network, environment-variable, and repository permissions.

Impact Assessment

...[truncated 499 chars]

Remediation

View remediation

Remediation Suggestions

• Require a reviewed lockfile and abort if it is absent or inconsistent.
• For Node.js projects, prefer npm ci over npm install; use --ignore-scripts where lifecycle scripts are unnecessary.
• For Python projects, use uv sync --frozen and approved package indexes.
• Replace npx next lint with a package-manager command that only executes the already-installed local binary, or use npx --no-install next lint.
• Do not automatically install missing dependencies during an audit; report the missing prerequisite and request user approval.
• Pin package-manager and runtime versions.
• Enforce trusted registries, package integrity verification, and dependency allowlists where practical.
• Run unavoidable dependency installation in a sandbox with restricted credentials, filesystem access, and outbound networking.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill gives contradictory authority boundaries: it says review should not auto-fix code, yet instructs the agent to edit spec.md, commit those edits, and later rewrite CLAUDE.md. In a review context, hidden state-changing behavior is dangerous because it can tamper with audit artifacts and repository history under the guise of validation, making the review non-independent and potentially masking unmet requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The pre-flight section forbids reading source code at that stage, yet the immediately following step 4 in the same flow instructs the agent to identify and read hub files for a code quality spot check. That creates contradictory procedural guidance about whether source code should be read during the review flow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to modify spec.md checkboxes and commit the result without user-facing disclosure or confirmation. Silent writes to requirement-tracking documents are dangerous in a review skill because they can falsify completion state, contaminate evidence, and create misleading audit trails that future automation or humans may trust.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Beyond reviewing code and running local quality checks, the skill instructs direct use of Vercel, Fly, Supabase, Wrangler, adb, and simulator/log-stream tooling to inspect runtime environments and production logs. Some runtime validation can support readiness, but broad operational and device-log access exceeds what the manifest narrowly frames as a code review skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to rewrite CLAUDE.md, trim content, and commit automatically creates undisclosed repository changes outside the user's immediate request. This is especially dangerous because CLAUDE.md often contains operational guardrails and workflow context; automatic rewriting can remove important constraints or inject misleading guidance for future agents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill extends beyond review into project management by appending fix tasks, changing plan status, and committing those changes automatically. That is risky because a supposedly final-review skill should not mutate planning artifacts or workflow state without approval; otherwise it can alter project status and trigger downstream automation based on its own findings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Appending tasks to plan.md, changing status, and committing on non-SHIP verdicts without warning is an undisclosed state change with workflow consequences. In an automated pipeline, this can silently steer project execution, create extra commits, and alter planning records based solely on the skill's internal logic.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.