Security audit
Security checks for vulnerabilities and agentic risk
This PR review skill is mostly coherent, but it can publish comments to Gitee pull requests without clearly requiring user confirmation.
Install only if you want an agent that may both analyze Gitee pull requests and post review comments back to them. Before using it, require the agent to show you the draft review and get explicit approval before calling comment_pull, and limit optional local git or file inspection to the intended repository.
The trigger phrases are broad enough that the skill could activate for generic requests like 'check a pull request' or similar wording without the user fully understanding the skill's capabilities and side effects. Because the skill can fetch repository data and post comments, accidental invocation can lead to unintended external actions.
The skill explicitly expands beyond Gitee MCP review operations by permitting local git commands and local file access when run inside a repository. That broadens the trust boundary from PR metadata and diffs to arbitrary local workspace contents, which can expose unrelated sensitive files or cause the agent to act on attacker-influenced repository state outside the declared MCP-only scope.
Instructing the agent to use local git commands grants an unnecessary execution capability for a review skill that otherwise could rely on MCP APIs. Even if intended for convenience, command execution against a local checkout increases risk from prompt injection in repository content, unintended access to developer environment data, and over-collection beyond the PR diff.
The skill directs automatic posting of review comments to the PR without a user-facing warning or confirmation. This creates a real risk of unintended external side effects, including publishing inaccurate reviews, leaking analysis context, or taking action when the user only asked for an internal review/check.
The manifest says to use the skill when asked to review or check a PR, which can reasonably imply analysis, but the body also instructs the agent to perform a write action by posting a comment with comment_pull. Because this is an externally visible modification to the PR, the write-back behavior is broader than a purely descriptive review unless clearly disclosed.
No suspicious patterns detected.
