Sovereign code-review-helper

• Outcome: Pass
• Latest audit: May 28, 2026 at 6:09 AM UTC
• Version:
  1.0.0

Overview

This is a local code-review checklist tool with disclosed git/Bash use and no evidence of hidden data theft or destructive behavior.

Install only if you are comfortable with a Bash script reading changed files in your git repository. Use explicit invocation when possible, review any --output-file path before running it, and treat --files as a grep regex filter rather than a shell glob.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are generic terms like "code review" and "security check," which are likely to appear in normal user conversations and can cause the skill to activate unintentionally. Because the skill requires shell-capable tools and points to a script entrypoint, accidental invocation could expand execution surface or cause unplanned behavior even if the skill itself appears legitimate.

VirusTotal

65/65 vendors flagged this skill as clean.