Security audit

Code Review (Gemini AI)

Security checks across malware telemetry and agentic risk

Overview

This Gemini code-review skill mostly matches its purpose, but it can upload selected code to Google using an embedded fallback API key without a runtime confirmation.

Install only if you are comfortable with reviewed code or file contents being sent to Google Gemini. Set your own GEMINI_API_KEY, avoid submitting repositories or files that may contain secrets or confidential data, and treat the embedded fallback API key as a reason to patch or audit the script before using it on sensitive work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares no permissions, yet its documented behavior and metadata indicate use of environment variables and outbound network access to Gemini. This undermines transparency and permission-based review, making it easier for users or platforms to approve a skill without understanding that code or snippets may be sent externally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 70% confidence
Finding: A description-behavior mismatch is dangerous because users may trust the stated local code-review purpose while the skill actually relies on an external web API and may not behave as broadly as advertised. If a hardcoded default API key is truly present in the implementation, that also creates credential exposure and unauthorized-use risk on top of the transparency problem.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill description claims project-wide review and debugging, but the implementation only reads a single CLI argument or one file and submits that content. This mismatch can mislead users about what data is analyzed and what security/privacy boundaries apply, which is dangerous in a security-sensitive tool because users may assume broader or different behavior than actually occurs.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script transmits supplied code to Google's Gemini API, but that external data transfer is not disclosed in the manifest description. In a code-review skill, this is particularly sensitive because source code may contain proprietary logic, secrets, credentials, or customer data, and undisclosed exfiltration to a third party creates material confidentiality risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill encourages reviewing projects, files, and inline code with Gemini but does not clearly warn that submitted source code is transmitted to a third-party service. This can lead to unintended disclosure of proprietary code, secrets, or regulated data, especially in a code-review context where sensitive repositories are common.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script sends user-supplied code content to an external API without any warning, confirmation, or disclosure at runtime. Because code review inputs often include unreleased source, embedded secrets, and internal business logic, silent transmission to a third party increases the risk of unintentional data leakage.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.