Security audit

Code Review Automation

Security checks across malware telemetry and agentic risk

Overview

This is a coherent GitHub pull-request review tool that uses Claude as advertised, but users should treat private PR diffs as data shared with Anthropic.

Install only if you are allowed to share the target PR content with Anthropic. Use --skip-llm or disable LLM review for sensitive/private code, keep .env out of source control, and use a fine-grained read-only GitHub token scoped to the specific repositories you need.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README documents sending pull request content to Claude for AI review but does not clearly warn users that proprietary code, secrets in diffs, or sensitive metadata may be transmitted to a third-party service. In a code-review automation skill, this omission is material because users may reasonably assume analysis is local unless external data sharing is explicitly disclosed.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The review-pr documentation says PRs are analyzed with Claude AI but does not explicitly warn that pull request content and potentially repository code may be transmitted to an external third-party API. In a code review context, PRs often contain proprietary code, secrets, or sensitive business logic, so omission of this disclosure can lead to unintended data exfiltration.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The full-review command combines LLM analysis with other checks but does not disclose that repository and PR data may be sent to an external LLM service unless the user explicitly skips LLM analysis. Because full-review sounds like a comprehensive local workflow, users may unknowingly transmit sensitive source code or metadata off-platform.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The review_pr command retrieves full PR diff content and sends it to an external AI service for analysis, but the CLI does not provide an explicit warning, consent step, or redaction control before transmission. In code-review contexts, diffs can contain proprietary code, secrets, credentials, or regulated data, so silent exfiltration to a third party creates a real confidentiality risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The full_review workflow can automatically send PR diff content to Claude when LLM analysis is enabled, again without a clear warning at execution time. Because this is bundled into a broader 'full review' action, users may not realize source code is being transmitted off-platform, which increases the likelihood of unintentional data disclosure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code sends PR-derived content to Anthropic via `self.client.messages.create(...)`, and this file contains no consent gate, redaction step, or user-facing notice before transmitting potentially sensitive repository data off-platform. In a code-review automation skill, PR diffs can contain secrets, proprietary code, internal URLs, or security-relevant details, so external transmission creates a real confidentiality and compliance risk.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The PR title, body, filenames, and diff are interpolated directly into the same prompt that contains the reviewer instructions, with no separation of trusted instructions from untrusted data. Because PR authors control much of that content, they can embed prompt-injection text in descriptions or code comments that steers the model to ignore review criteria, suppress findings, or produce misleading output.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.