Code Review Bot

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:36 AM UTC
• Version: 0.1.0

Overview

This PR review skill is mostly purpose-aligned, but its shell-command instructions accept user-provided GitHub identifiers without explicit validation, so it should be reviewed before use.

Install only if you are comfortable granting the agent read access through gh/GITHUB_TOKEN. Before using it, validate that PR numbers are digits-only and repository names are a simple owner/repo value, avoid pasting untrusted values into a shell command, and treat all rendered PR metadata as untrusted text rather than instructions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31

Finding

Unvalidated and Unquoted Shell Command Placeholders

Content

View full analysis

--repo --json number,title,body,author,baseRefName,headRefName,changedFiles,additions,deletions,labels,isDraft,mergeable > pr.json ``` 2. Collect status checks: ```bash gh pr checks --repo --json bucket,name,state,workflow > checks.json ``` ``` ### Technical Analysis The documented commands instruct the Agent to interpolate a pull-request number and repository identifier directly into shell commands. Neither placeholder is quoted, and the instructions do not require validation before command execution. If these values are copied from an untrusted user request, shell metacharacters embedded in either value can alter the command structure. Characters and constructs such as semicolons, command substitutions, pipelines, and redirections could cause additional commands to run under the privileges of the Agent process. The fixed output redirections to `pr.json` and `checks.json` are not themselves attacker-controlled. The weakness is the absence of a strict input contract and safe argument-passing mechanism for the interpolated values. ### Attack Path 1. An attacker requests a review using a repository identifier or pull-request value containing shell syntax. 2. The Agent substitutes that value into one of the commands documented in `SKILL.md`. 3. The Agent invokes the command through a shell without quoting or validating the substituted value. 4. The shell interprets the injected metacharacters rather than treating the entire value as a single `gh` argument. 5. An attacker-selected command executes with the same operating-system privileges and environment access as the Agent. Successful exploitation depends on the calling Agent perfo ...[truncated 767 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/review_helper.py:34

Finding

Untrusted GitHub Metadata Is Rendered as Agent-Consumed Markdown

Content

View full analysis

{pr_data.get('baseRefName', '?')}", f"- Scope: {pr_data.get('changedFiles', 0)} files, +{pr_data.get('additions', 0)} / -{pr_data.get('deletions', 0)}", f"- Labels: {labels}", "", "## Risk Signals", ] if risk_signals: lines.extend(f"- {signal}" for signal in risk_signals) else: lines.append("- no automatic high-risk signals detected") lines.extend(["", "## Failing Checks"]) if failing: lines.extend( f"- {check.get('name', 'unknown')} ({check.get('workflow', 'workflow')})" for check in failing ) else: lines.append("- none") lines.extend(["", "## Pending Checks"]) if pending: lines.extend( f"- {check.get('name', 'unknown')} ({check.get('workflow', 'workflow')})" for check in pending ) ``` The resulting text is then consumed according to: ```text 4. Use the rendered summary to write the final human-facing review. ``` ### Technical Analysis Pull-request titles, author names, branch names, labels, check names, and workflow names originate from repository-controlled GitHub metadata. These values are inserted directly into Markdow ...[truncated 2429 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes shell commands through gh and python but does not declare any permissions or allowed-tools scope, so an agent may run it with broader-than-necessary capabilities. That increases the risk of unintended command execution or access beyond the minimum needed, especially because PR metadata and repository context are explicitly untrusted inputs in this workflow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_review_helper.py (reported line 10)May include surrounding context.

python

class ReviewHelperTests(unittest.TestCase):
    def test_review_pack_contains_sections(self):
        base = Path(__file__).parent
        result = subprocess.run(
            [
                sys.executable,
                str(base / "scripts" / "review_helper.py"),

Static analysis

No suspicious patterns detected.