Security audit

Code Review Automation

Security checks for vulnerabilities and agentic risk

Overview

This code review skill matches its stated purpose, but it needs Review because it asks for an overly broad GitHub token and its LLM review can be influenced by untrusted pull request text.

Before installing, use a fine-grained GitHub token limited to the specific repositories and read-only permissions needed for contents, metadata, and pull requests. Treat Claude's review and quality score as advisory because PR content is untrusted and is sent to the LLM; keep human review and deterministic checks independent of the generated merge recommendation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: code_review/pr_analyzer.py:136
Finding: Untrusted Pull Request Content Can Hijack the LLM Review
Content: View full analysis
Vulnerability Details

File Location: code_review/pr_analyzer.py:136-157 and code_review/pr_analyzer.py:177-207
Vulnerability Type: Prompt injection through untrusted pull request content
Risk Level: High

Vulnerable Code

python
context = f""" # Pull Request Context **PR Title:** {pr.title} **PR Description:** {pr.body or "No description provided"} **Author:** {pr.user.login} **State:** {pr.state} ## Files Changed {files_str} ## Code Diff {diff_content[:10000]} # Limit to 10k chars to avoid token limits """ return context

python
prompt = f"""You are an expert code reviewer. Analyze the following pull request and provide a comprehensive code review. {context} ## Your Task Provide a structured code review with the following sections: ### 1. Overall Assessment - Brief summary of the PR's purpose - General impression (positive/negative/mixed) - Is the PR ready to merge? ### 2. Code Quality Issues - Identify any bugs or potential bugs - Logic errors - Performance concerns - Code style issues ### 3. Security Considerations - Any security vulnerabilities - Sensitive data handling - Authentication/authorization issues ### 4. Best Practices - Missing error handling - Code organization - Naming conventions - Documentation ### 5. Recommendations - Specific improvements with line-by-line suggestions where appropriate - Priority levels (Critical, High, Medium, Low) Format your response in markdown with clear headings. Be specific and actionable.""" return prompt

Technical Analysis

Pull request titles, descriptions, filenames, author-controlled file contents, and diffs are untrusted data. The application directly interpolates this data into the same user message that contains the trusted review instructions.

No explicit trust boundary tells the model that instructions embedded in the pull request must be treated sol ...[truncated 1947 chars]
Remediation: View remediation
Remediation Suggestions

Place the immutable review policy in an Anthropic system message rather than combining it with repository content in a user message.

Explicitly state that PR metadata, filenames, comments, documentation, strings, and diff contents are untrusted data and that any instructions found inside them must not be followed.

Wrap each untrusted field in clear structural delimiters and label it as data. Use a serialization format that keeps instructions and content structurally separate.

Require structured output that conforms to a strict schema, including enumerated severity values and evidence locations.

Validate the response before displaying or scoring it. Reject malformed responses, unexpected instructions, and claims lacking references to the supplied diff.

Do not treat an LLM-generated merge recommendation or score as an authorization decision. Keep deterministic scanners and mandatory human review independent of the model output.

Add adversarial tests using injection strings in PR titles, descriptions, filenames, and source comments.

Clearly warn users that repository content is externally submitted to an LLM and that generated findings may be influenced by hostile content.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:42
Finding: Documentation Requests an Overprivileged GitHub Personal Access Token
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:42-50 and README.md:33-46
Vulnerability Type: Excessive GitHub token permissions
Risk Level: Medium

Vulnerable Documentation

markdown
### 2. Setup GitHub API Token Get your GitHub Personal Access Token: 1. Go to GitHub Settings → Developer settings → Personal access tokens 2. Generate a new token with `repo` scope 3. Create `.env` file: ```env GITHUB_TOKEN=your_github_pat_here

text
The README provides equivalent guidance: ```markdown ### 2. Setup GitHub API Token Create a `.env` file in the skill directory: ```env GITHUB_TOKEN=your_github_pat_here

Get your GitHub Personal Access Token:

Go to GitHub Settings → Developer settings → Personal access tokens

Generate a new token (classic)

Select repo scope (required for full functionality)

Copy the token and add it to .env file

text
### Technical Analysis The audited implementation performs read-only GitHub operations: retrieving repository information, pull requests, pull-request metadata, changed files, and patches. It does not create commits, merge pull requests, update repository settings, or otherwise require broad repository write access. Nevertheless, the installation documentation directs users to create a classic personal access token with the broad `repo` scope. For private repositories, that scope grants substantially more access than the implemented functionality requires and can include repository write capabilities. This violates the principle of least privilege. The code stores the token in a project-local `.env` file. Although no direct token exfiltration was found, any local compromise, accidental file disclosure, malicious dependency, or unrelated process that obtains the token receives all permissions assigned to it. Requesting excessive permissions therefore increases the consequences of a separate credential compromise. ### Attac ...[truncated 1140 chars]
Remediation: View remediation
Remediation Suggestions

Replace the recommendation for a classic repo token with a fine-grained personal access token.

Restrict the token to only the repositories that users intend to review.

Grant read-only permissions for repository metadata, contents, and pull requests, subject to the exact permissions required by PyGithub endpoints.

Document the minimum required permissions separately for public and private repositories.

State explicitly that write permissions, administration permissions, workflow permissions, and organization-wide access are not required.

Encourage short expiration periods, regular rotation, and immediate revocation following suspected disclosure.

Ensure .env is excluded from version control and recommend restrictive filesystem permissions.

Consider supporting GitHub App authentication with narrowly scoped, short-lived installation tokens for organizational deployments.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (55)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG.md (reported line 386)May include surrounding context.
md
### Prerequisites - Python 3.8 or higher - GitHub Personal Access Token (PAT) - (Optional) Anthropic API Key for LLM analysis ### 1. Install Dependencies

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 20)May include surrounding context.
md
### Prerequisites - Python 3.8 or higher - GitHub Personal Access Token (PAT) - (Optional) Anthropic API Key for LLM analysis ### 1. Install Dependencies

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 40)May include surrounding context.
md
### Prerequisites - Python 3.8 or higher - GitHub Personal Access Token (PAT) - (Optional) Anthropic API Key for LLM analysis ### 1. Install Dependencies

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
### Prerequisites - Python 3.8 or higher - GitHub Personal Access Token (PAT) - (Optional) Anthropic API Key for LLM analysis ### 1. Install Dependencies

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
md
### Prerequisites - Python 3.8 or higher - GitHub Personal Access Token (PAT) - (Optional) Anthropic API Key for LLM analysis ### 1. Install Dependencies

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 41)May include surrounding context.
text
Get your GitHub Personal Access Token: 1. Go to GitHub Settings → Developer settings → Personal access tokens 2. Generate a new token (classic) 3. Select `repo` scope (required for full functionality) 4. Copy the token and add it to `.env` file

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
text
Get your GitHub Personal Access Token: 1. Go to GitHub Settings → Developer settings → Personal access tokens 2. Generate a new token (classic) 3. Select `repo` scope (required for full functionality) 4. Copy the token and add it to `.env` file

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code chunk is limited to GitHub repository/PR retrieval operations via the GitHub API. It accesses repository and pull request data, including diffs and metadata, which could support a review system, but it does not itself analyze code, review PRs, scan for security issues, or check style. Therefore the declared description overstates the behavior of this supplied code chunk in a materially important way.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code chunk does not implement automated code review functionality. It is a test utility that runs 'python -m code_review.cli ... --help' for various commands and prints outputs/errors. Its primary purpose is validating CLI help command availability, which is materially different from the declared purpose of reviewing GitHub PRs with Claude, performing security scans, and checking style. While this may be related to the broader project, the chunk itself is a testing harness and does not match the declared behavior.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/claude_client.py (reported line 13)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/claude_client.py (reported line 41)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/claude_client.py (reported line 42)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 36)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 82)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 121)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 165)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 217)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 253)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 257)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 318)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 405)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/cli.py (reported line 496)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/github_client.py (reported line 13)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/github_client.py (reported line 41)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · code_review/github_client.py (reported line 42)May include surrounding context.
python
from .exceptions import AuthenticationError, RateLimitError, ConfigurationError from .logger import setup_logger, log_exception # Load environment variables from .env file SKILL_DIR = Path(__file__).parent.parent ENV_FILE = SKILL_DIR / ".env" load_dotenv(ENV_FILE)

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Documentation

Remediation Suggestions

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis