OC Code Review

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:33 PM UTC
• Version:
  1.0.0

Overview

This is a coherent code-review helper with minor scoping and packaging cautions, not evidence of malicious behavior.

Install this if you want an agent-assisted code review workflow. When invoking it, name the exact files, PRs, repositories, documents, or URLs to review, and avoid granting broad private-code access unnecessarily. Be aware that one referenced performance checklist is missing from the package.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes very broad terms such as "review" and "审查", which can cause the skill to activate in contexts far beyond code review. In an agent environment, overbroad invocation can redirect unrelated user tasks into tool-using review flows, increasing the chance of unnecessary file access, command execution, or confusing behavior.

VirusTotal

66/66 vendors flagged this skill as clean.