Engineering manager 1-on-1 meeting brief generator

• Outcome: Pass
• Latest audit: Aug 24, 2026 · 12:08 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed GitHub activity brief generator with expected local files, GitHub API use, and an opt-in mode that can send bounded PR discussion text to an LLM.

Install only if you are comfortable giving the skill GitHub read access appropriate to the repos being analyzed and sending the prepared prompt to your AI provider. Use GITHUB_ORG and fine-grained tokens where possible, review .pullstar/llm_input_<login>.json before inference, and avoid --pr-insights for confidential discussions unless that transfer is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documents powerful capabilities including environment access, file read/write, shell execution, and network access, but does not declare permissions explicitly. This increases the risk of over-privileged execution because operators and policy systems cannot easily evaluate or constrain what the skill is allowed to do before use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill is described as a fully deterministic 5-call pipeline, but the content also requires external GitHub API calls and an LLM inference step performed by the agent. This mismatch can mislead reviewers about non-determinism, data egress, and operational behavior, causing the skill to be trusted or approved under incorrect assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The optional --pr_insights mode collects and persists excerpts of PR review bodies and issue comment bodies, which goes beyond minimal activity metadata and can capture sensitive internal discussion, code-review remarks, or confidential project context. In this skill context, generating a 1-on-1 brief does not clearly require storing raw discussion excerpts on disk, so the data collection is broader than necessary and increases privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code serializes the full LLM payload, including engineer identifiers and the user message that may contain raw PR review/comment excerpts, to a local JSON file on disk. Persisting potentially sensitive collaboration text without minimization, redaction, retention controls, or clear consent increases the risk of unintended disclosure through local compromise, backups, logs, artifact collection, or shared workspaces.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script explicitly instructs an agent to read a generated JSON artifact and send its system and user fields to an LLM, but it provides no consent, classification, or data-handling warning. In this skill context, the prepared brief may contain GitHub activity, review context, and potentially sensitive organizational metadata, so the omission creates a real risk of unintended off-host data disclosure.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: This code intentionally packages raw PR titles, review bodies, and comment bodies into the LLM prompt with only size truncation and no semantic filtering or secret/sensitive-data scrubbing. Because review/comment text is user-provided and may contain credentials, internal URLs, incident details, personal data, or other confidential material, sending it verbatim to an LLM materially increases data leakage risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.