code-review

• Outcome: Review
• Latest audit: Aug 3, 2026 · 1:07 AM UTC
• Version: 2.2.0

Overview

This code-review skill is mostly purpose-aligned, but it has under-scoped persistent writes and broad activation triggers that users should review before installing.

Install only if you want an opinionated code-review workflow that can read repository diffs/history, spawn review agents, and create local review artifacts. Before routine use, narrow the activation trigger, remove or gate the record.md update, and require explicit output paths for generated reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly directs use of shell commands, file reads/writes, and environment-dependent tooling, yet it declares no permissions or capability boundaries. That creates a least-privilege failure: a caller may invoke a seemingly harmless review skill that can modify files, generate reports, and access repository state without explicit disclosure or gating.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared description frames the skill as code review, but the body authorizes additional behaviors: repository interrogation via git, Python-based dependency analysis, and writing HTML or other artifacts to disk. This mismatch is dangerous because users and orchestrators may grant trust based on the summary while the skill performs broader actions than advertised.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Persistent annotation storage and report generation go beyond transient code review and create lasting artifacts that may contain sensitive code excerpts, findings, or paths. If invoked automatically, this can leak internal information into workspace files or accumulate data without user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instruction to update record.md after completion introduces an unrelated write side effect not necessary for code review. Hidden file modification is risky because it can alter repository state, pollute commits, or be abused to persist data in a place the user did not ask to change.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The serve command writes an HTML report to a hardcoded path under a specific workspace directory in the user's profile, regardless of user intent or explicit output selection. In an agent/skill context, fixed-path writes are risky because they can overwrite existing files, leak reviewed content into a shared workspace, and create side effects outside the caller's expected output location.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Overly broad triggers like generic 'review' can cause accidental activation during normal conversation or when a user intended a different built-in command. Because this skill can run shell commands and write files, misrouting innocent prompts into this skill meaningfully raises the risk of unintended actions.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: Ambiguous triggers for broad concepts like visual or multi-agent review lack clear constraints on target, scope, or required artifacts. In a skill with side effects and subprocess behavior, ambiguity increases the chance of unintended execution paths or unnecessarily broad analysis.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill directs file modification after task completion without a user-facing warning, violating transparency expectations for a review tool. While lower impact than arbitrary shell execution, undisclosed writes are still a security and trust concern because they silently change workspace contents.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The HTML report is silently persisted to a fixed workspace path, with only a status message after the write occurs. For a review tool that may process sensitive source diffs and annotations, this can expose code contents or metadata in an unintended location and makes file creation harder for users or calling agents to control.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 89% confidence
• Finding: Using the trigger 'review' conflicts with a built-in command and can shadow expected platform behavior. That is dangerous here because the shadowing skill has broader capabilities, including shell and file operations, so users may unknowingly invoke this custom workflow instead of the safer native command path.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/diff_renderer.py:31

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/report_generator.py:31