polish-new

• Outcome: Review
• Latest audit: Aug 27, 2026 · 7:13 PM UTC
• Version: 0.1.1

Overview

This review skill has a coherent development purpose, but it can make repository changes before explicit approval and can be triggered by broad natural-language requests.

Install only if you want an agentic review workflow that can write run artifacts, edit ignore metadata, run project checks, spawn review agents, and modify code. Before use, consider narrowing activation to `/polish-new` and requiring explicit approval before any code or ignore-file changes, including pre-existing check failures and follow-up fix-review edits.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The skill advertises activation on broad phrases like 'polish' or 'pre-release review before committing or pushing', which can match ordinary user requests and trigger a complex workflow with file creation, code modification, and agent fan-out. In this context, over-broad activation is risky because the skill is stateful and can make repository changes, so accidental invocation can cause unintended edits or review side effects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill begins operational phases that create `.agents/...` directories, write a ledger, and modify ignore files without an upfront warning in the description that it will change repository state. This is dangerous because users may invoke what sounds like a review-only skill without realizing it performs writes to the working tree and project metadata.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Phase 1 instructs the agent to automatically fix all lint/type-check failures before any review approval, including failures that predate the diff. That permits code changes without explicit user authorization and can expand scope beyond the requested review, potentially altering unrelated code or masking provenance of changes.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Does each new or strengthened test fail when its fix is reverted?
- Did any fix reverse a decision recorded in the ledger without saying so?

Classify the round's findings and act autonomously - no approval gate here:

- **Defects** - a fix does not hold, is class-incomplete, or introduced a problem: fix them now; the next round reviews only those new edits
- **Residuals** - cosmetic, taste, or not worth an edit: record in the ledger, disclose in the summary, no edit, no new round

• Confidence: 96% confidence
• Finding: The fix-review phase explicitly authorizes the skill to classify findings and apply additional fixes autonomously with 'no approval gate here.' Even though this occurs after initial approval, it grants the agent open-ended authority to make further code changes introduced by its own review loop, which can exceed the user's intended scope and compound erroneous edits.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.