code-review

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.0

Overview

This is a disclosed code-review helper with a lightweight local checker and optional local learning log; I found no hidden execution, data exfiltration, or destructive behavior.

Install only if a Chinese-language code-review workflow is acceptable. The review checker is heuristic and should not be treated as comprehensive security analysis. If using learner.py, point it only at a directory where creating or updating learned_patterns.json is acceptable, and do not include secrets or private code in learning notes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill claims broad structured review of diffs, PRs, correctness, security, performance, readability, and tests, but the documented implementation appears limited to a single-file checklist precheck with sparse pattern matching. This overclaim can create unsafe reliance: users may trust the skill to catch security or correctness issues that it does not actually analyze, leading to missed vulnerabilities or bad deployment decisions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill claims broad structured review of diffs, PRs, correctness, security, performance, readability, and tests, but the documented implementation appears limited to a single-file checklist precheck with sparse pattern matching. This overclaim can create unsafe reliance: users may trust the skill to catch security or correctness issues that it does not actually analyze, leading to missed vulnerabilities or bad deployment decisions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest says this skill performs structured code review, but the implementation primarily reads and writes local learning data to arbitrary skill directories. This capability mismatch is dangerous because it gives the skill file-system persistence behavior not implied by its stated purpose, which can be used to retain user-derived data or modify local state under the cover of a benign code-review tool.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 77% confidence
• Finding: The skill references local scripts that can write state (for example, the learning workflow that records data and updates local JSON state), but the manifest does not declare any explicit tool scope or permission boundary. This creates an authorization ambiguity where a reviewer-facing skill appears read-only while still encouraging stateful writes, increasing the risk of unexpected file modification or overbroad runtime privileges.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The invocation examples include broad phrases such as '帮我 review 代码', '检查这段有什么问题', and '看看这个 PR', which are common conversational requests and not narrowly scoped activation triggers. The description does not provide exclusion conditions or clearer boundaries for when this skill should activate versus a general assistant response.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill description and user-facing instructions are entirely in Chinese and describe the assistant as a Chinese-language code review helper, with no indication that users may choose another language. This can violate language/locale policy when the skill implicitly constrains output language without explicit opt-in or justification.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This file implements a generic cross-skill persistence and self-learning mechanism rather than code-review logic. In a code-review skill, unrelated stateful components expand the trust boundary, enable unnecessary accumulation of user/task metadata, and create opportunities for hidden behavior or future misuse without user expectation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code file contains natural-language instructions, descriptions, and CLI output that force a specific language/locale for all users. Under the stated policy, language-specific behavior without user opt-in or documented justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The module docstring is written entirely in Chinese and presents the skill's purpose in a fixed locale, with no indication that language is user-selectable or that the tool is intentionally region-specific. This can violate language/locale policy when a skill implicitly constrains communication to one language without opt-in.

Static analysis

No suspicious patterns detected.