Security audit

code-polish

Security checks across malware telemetry and agentic risk

Overview

This review skill is mostly purpose-aligned, but it asks the agent to run repository-defined commands and make fixes beyond its declared tool scope, including some fixes before clear approval.

Review this skill before installing if you use it on untrusted repositories. It may run project-specified validation commands and edit files; only use it where you are comfortable executing the repo's scripts, and prefer requiring explicit approval before any validation command or automatic fix runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest restricts allowed tools to read-oriented git commands, but the instructions later tell the agent to edit files and rerun project validation commands. That mismatch is dangerous because operators may trust the manifest as a safety boundary while the workflow text encourages broader side effects, creating a policy-bypass or unsafe-expectation gap.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs execution of project-defined validation commands sourced from CLAUDE.md, which can be arbitrarily controlled by the repository under review. This creates an arbitrary code-execution path in the local workspace, potentially running malicious scripts during what appears to be a review task.

Description-Behavior Mismatch

High

Confidence: 90% confidence
Finding: The documentation depends on parallel agent launches via an Agent/model invocation path, while the manifest disables model invocation and declares no such capability. This inconsistency is risky because it undermines operator assumptions about what the skill can do and may lead to fallback behavior, hidden capability expansion, or failed enforcement of execution constraints.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a pre-release review flow, but Phase 6 authorizes code modification and even commit-history manipulation after approval. Expanding from analysis into mutation is security-relevant because users may invoke a 'review' skill expecting read-only behavior, while it can materially alter source and version history.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The instruction to 'ask the user what to run' conflicts with a disabled model-invocation setting, indicating the documented control flow cannot be reliably enforced as written. While not direct code execution by itself, such contradictions degrade trust and can cause unsafe manual or fallback handling when required safeguards are unclear.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Running project validation commands without an explicit user-facing warning hides the fact that repository scripts may execute arbitrary shell code and modify the workspace. In the context of reviewing untrusted code, this is especially dangerous because an attacker can place malicious commands in the expected validation path and get them executed under the guise of linting or type-checking.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.