Security audit
Security checks for vulnerabilities and agentic risk
This skill is a plain pull request review checklist with broad review triggers, but it does not request risky access or perform hidden actions.
Before installing, consider whether you want a general review checklist to activate on common phrases like 'code review' or 'review diff'. The skill appears safe, but its broad triggers may make it show up more often than a narrowly named PR-review helper.
The trigger 'review PR' semantically overlaps with the built-in 'review' command, creating a shadowing risk where the custom skill may be selected instead of the expected built-in behavior. This can alter execution flow, produce inconsistent results, and reduce user control over which review mechanism is invoked.
The description is broad enough to match a very wide range of normal development requests, which can cause the skill to activate outside narrowly intended contexts. Overly broad activation increases the chance of unintended routing, causing users to invoke this skill when they meant a different review flow or a built-in capability.
The trigger 'review changes' is highly likely to collide with a generic built-in review action because it is a natural-language variant of the same command. Such overlap increases the chance that users unintentionally invoke this skill when requesting a standard review operation.
The trigger 'review diff' closely maps to common built-in review terminology and is therefore prone to command shadowing. In practice, this can hijack expected command resolution and route users into a custom skill without clear intent, especially in review-heavy workflows.
The trigger phrases are short, generic, and common in everyday engineering conversation, making accidental invocation likely. Because these phrases overlap with routine requests, the skill may intercept user intent too broadly and create confusion or undesired execution paths.
No suspicious patterns detected.
