pr-review

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:38 PM UTC
• Version: 2.0.1

Overview

This skill is a code review helper that openly reads repository context and edits code to fix high-confidence issues, with no evidence of hidden exfiltration, persistence, or destructive behavior outside that purpose.

Install this only if you want a review command that may edit your repository files automatically. Run it on a branch or clean working tree, review the resulting git diff, and avoid using it in repositories where CLAUDE.md or .claude/settings.json contain sensitive local instructions you do not want included in review context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to read CLAUDE.md and .claude/settings.json, which are agent/configuration files rather than code under review. Those files can contain sensitive local instructions, secrets, or environment-specific operational guidance, and pulling them into model context unnecessarily expands the attack surface and may leak privileged information into subsequent outputs or decisions. In a PR review skill, this is more dangerous because the task can be triggered on arbitrary repositories, so untrusted repo content can cause the agent to ingest hidden configuration and cross-contaminate the review context.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Read project guidelines (quick scan, don't overthink):

bash

# Check for project conventions
cat CLAUDE.md .claude/settings.json CONTRIBUTING.md 2>/dev/null | head -100
cat .eslintrc* .prettierrc* biome.json tsconfig.json 2>/dev/null | head -50
cat package.json 2>/dev/null | head -20  # tech stack

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file states that the skill performs 'Auto-fix for issues with confidence >= 70' but does not include any warning, limitation, or user-facing caution about modifying project files. Because automatic fixes can affect user data and system integrity, the description should disclose this behavior clearly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README prominently advertises that the skill will automatically fix issues directly in user code, but it does not provide a clear upfront safety warning about unintended modifications, review requirements, or the need for backups/clean git state before execution. In a tool that edits source files, especially one using multiple agents and relatively permissive confidence thresholds, this can lead to accidental code corruption, insecure fixes, or loss of user work if users invoke it without fully understanding the risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is presented as an audit of existing code, but later instructs the agent to directly edit files and apply fixes. That mismatch can cause users to invoke a read-oriented review command while unintentionally authorizing repository modifications, increasing the risk of silent or unexpected code changes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation says the command audits code 'as it exists,' which implies inspection rather than mutation, yet the procedure mandates direct fixes for issues above a threshold. In an agentic environment, this kind of documentation/behavior inconsistency is dangerous because it weakens informed consent and can lead to unreviewed modifications in sensitive repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill authorizes direct repository edits for high-confidence findings without requiring an upfront warning or explicit user approval for file changes. Because the allowed tools include Edit and Write, a user asking for an 'audit' could trigger immediate source modifications, potentially corrupting code, introducing regressions, or changing security-sensitive logic without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly tells the agent to "fix issues directly" and later to edit code, but it does not warn up front that invoking this skill will modify user files. In a PR-review context, users may reasonably expect analysis or comments rather than automatic edits, so this can lead to unintended repository changes and unsafe trust in autonomous modifications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Line L04 contains a Portuguese trigger phrase as a positive activation example, indicating the skill is intended to activate on that language. In this file there is no accompanying natural-language note offering language choice or justifying locale handling, which creates a potential language/locale policy concern under the stated rules.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The instructions require reading git diff, blame, and history to analyze changes, which can expose code and commit metadata during agent processing. The markdown does not disclose this repository-analysis behavior up front, even though it may have privacy or sensitivity implications for some users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.