MergeIQ: Automatically Score & Prioritise PR Complexity for GitLab and GitHub

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:16 PM UTC
• Version:
  1.0.1

Overview

MergeIQ is a local PR/MR complexity scorer; its repository metadata and token examples are expected for GitHub/GitLab use, with no hidden execution or persistence found.

Install only if you are comfortable providing PR/MR metadata to the local scorer and to GitHub or GitLab through the documented API calls. Use least-privilege read-only tokens, prefer environment variables or a secure credential manager, and avoid saving or sharing fetched JSON from private repositories unless needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The examples instruct users to send repository and review metadata to external APIs using bearer/private tokens but provide no warning about credential handling, token scope, shell history, or the sensitivity of repository data. This can lead users to expose secrets or process private code metadata without understanding the risk.

VirusTotal

63/63 vendors flagged this skill as clean.