RedHat Code Review

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.0

Overview

This is a text-only code review skill whose instructions match its stated purpose, with a malformed trigger field that should be fixed but does not show hidden or unsafe behavior.

Before installing, treat this as a normal code-review helper: only provide code or diffs you are comfortable sharing with your agent runtime. The publisher should fix the malformed trigger metadata so the skill activates only for intended review requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger configuration is effectively malformed or underspecified: `triggers: System.Object[]` does not define concrete activation phrases, scope, or constraints. In an agent environment, ambiguous trigger definitions can cause the skill to activate unexpectedly or too broadly, increasing the chance of misuse, unintended invocation during unrelated tasks, or security-relevant review actions being applied in the wrong context.

VirusTotal

63/63 vendors flagged this skill as clean.