gstack-review-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:19 AM UTC
• Version: 1.0.0

Overview

This code-review skill is coherent, but it automatically runs project commands that can execute untrusted code without clear consent or sandboxing.

Install only if you are comfortable with the agent running test, lint, type-check, and build commands from repositories you review. For untrusted branches or pull requests, ask the agent to do static review only, or run checks inside a disposable sandbox with no credentials and restricted network access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:53

Finding

Automatic Execution of Untrusted Repository-Controlled Commands

Content

View full analysis

&1 || pytest 2>&1 || cargo test 2>&1 || true) TEST_EXIT=$? # Type check / lint LINT_OUTPUT=$(npm run lint 2>&1 || npx tsc --noEmit 2>&1 || true) # Build check BUILD_OUTPUT=$(npm run build 2>&1 || cargo build 2>&1 || true) ``` ### Technical Analysis The skill instructs the agent to execute test, lint, compiler, and build commands from the repository being reviewed. Project-controlled mechanisms such as npm scripts, package lifecycle hooks, test discovery hooks, build scripts, and compiler plugins can execute arbitrary commands. A code-review target must be treated as untrusted because an attacker can place malicious configuration or scripts in a branch or pull request specifically to target the reviewer. The instructions do not require explicit user approval, repository trust validation, command inspection, sandboxing, restricted filesystem mounts, credential removal, or network isolation before execution. Although running tests and builds is relevant to code review, executing them directly under the agent's ambient privileges crosses the boundary between static inspection and arbitrary execution of repository-controlled code. ### Attack Path 1. An attacker creates a branch or pull request containing a malicious `package.json` test/build script, test initialization hook, build plugin, or equivalent project-controlled executable content. 2. A user asks the agent to review that branch or pull request. 3. The skill follows Step 1 and invokes `npm test`, `pytest`, `cargo test`, `npm run lint`, or a build command. 4. The malicious repository-controlled hook executes with the permissions and environment available to the agent. 5. The payload can acce ...[truncated 770 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:57

Finding

Unpinned Package Retrieval and Execution Through npx

Content

View full analysis

&1 || npx tsc --noEmit 2>&1 || true) ``` ### Technical Analysis If `npm run lint` fails, the fallback invokes `npx tsc` without a pinned package version, verified lockfile state, integrity policy, or prohibition on downloads. Depending on the installed npm/npx behavior and local dependency state, `npx` may resolve and retrieve a package from a configured registry and execute its binary. This makes the code-review process dependent on mutable external package resolution. It also conflates a genuine lint failure with permission to run a different tool. The command does not establish that the expected TypeScript compiler is already installed locally or that the resolved executable comes from an approved dependency. The issue creates a supply-chain execution path. Registry compromise, unsafe registry configuration, dependency resolution mistakes, or a malicious package selected by the command could result in arbitrary code execution. ### Attack Path 1. `npm run lint` fails or is unavailable in the reviewed repository. 2. The shell evaluates the fallback `npx tsc --noEmit`. 3. If an approved local executable is unavailable, `npx` may resolve or download executable package content using the configured registry. 4. The resolved executable and any applicable package behavior run with the agent's permissions. 5. Malicious package code can read exposed files and credentials, modify the workspace, or communicate over the network. ### Impact Assessment Exploitation can provide arbitrary code execution with the privileges of the agent process. The accessible scope may include the review workspace, inherited environment variables, package-manager credentials, user files, and network-accessi ...[truncated 300 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:53

Finding

Test and Build Failures Are Incorrectly Recorded as Successful

Content

View full analysis

&1 || pytest 2>&1 || cargo test 2>&1 || true) TEST_EXIT=$? # Type check / lint LINT_OUTPUT=$(npm run lint 2>&1 || npx tsc --noEmit 2>&1 || true) # Build check BUILD_OUTPUT=$(npm run build 2>&1 || cargo build 2>&1 || true) BUILD_EXIT=$? ``` ### Technical Analysis Each command chain ends in `|| true`. Consequently, the exit status of the command substitution is zero even when all preceding test or build commands fail. `TEST_EXIT=$?` and `BUILD_EXIT=$?` therefore capture the successful status of `true`, not the failure status of the relevant test or build command. The test chain also treats a failure from one ecosystem as a reason to execute commands from unrelated ecosystems. For example, a genuine `npm test` failure causes `pytest` and then `cargo test` to be attempted. This prevents reliable attribution of failures and can produce misleading output. Because the review template requires PASS/FAIL reporting, this logic can incorrectly represent failed validation as successful. An attacker does not need command execution to exploit the integrity issue; a malicious or defective change can deliberately make the intended check fail while the status-normalization logic records success. ### Attack Path 1. A reviewed change introduces a defect or intentionally causes the relevant test or build command to return a nonzero exit status. 2. The shell proceeds through the fallback chain. 3. The terminal `true` command executes and returns zero. 4. `TEST_EXIT` or `BUILD_EXIT` is assigned zero. 5. The review process may interpret that value as a passing check and present an incorrect validation result. 6. Defective or malicious code may be appro ...[truncated 545 chars]

Remediation

View remediation

&1) TEST_EXIT=$? ``` 3. If shell error handling must be temporarily disabled, use a controlled pattern: ```bash set +e TEST_OUTPUT=$(npm test 2>&1) TEST_EXIT=$? set -e ``` 4. Record lint status separately using a dedicated `LINT_EXIT` variable. 5. Distinguish `PASS`, `FAIL`, `NOT RUN`, `TIMED OUT`, and `TOOL UNAVAILABLE` in the report. 6. Do not use failure of one tool as a trigger to run an unrelated ecosystem's tool. 7. Add validation tests for the skill's command logic to confirm that nonzero command statuses remain nonzero in the generated review result. ]]>

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

## 🏛️ CEO / Product Review
[Bulleted findings. Flag concerns in 🔴, praise good decisions in ✅]

**Verdict:** [Clear statement — ship it, rework it, or discuss with the team]

---

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

## 🏛️ CEO / Product Review
[Bulleted findings. Flag concerns in 🔴, praise good decisions in ✅]

**Verdict:** [Clear statement — ship it, rework it, or discuss with the team]

---

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

## 🏛️ CEO / Product Review
[Bulleted findings. Flag concerns in 🔴, praise good decisions in ✅]

**Verdict:** [Clear statement — ship it, rework it, or discuss with the team]

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger language is broad enough to activate on many generic 'review' requests, which can cause the skill to run repository inspection and command execution in contexts where the user did not clearly consent to that deeper behavior. Over-broad activation increases the chance of unintended tool use and can surprise users with side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description says it analyzes diffs and runs tests/checks, but it does not prominently warn that local shell commands will inspect the repository and may execute project-defined test, lint, and build scripts. Those scripts are attacker-controlled within the repository and can have arbitrary side effects, so omission of a clear warning weakens informed consent and safety boundaries.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs the agent to run npx tsc without pinning a package version or requiring a repo-local binary. In environments where typescript is absent locally, npx may fetch and execute code from the registry at runtime, creating a supply-chain and unreviewed code execution risk during skill execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.