Security audit

AI Code Review

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent code-review skill, but it can move from review into automatic repository edits, commits, and pushes without a clear approval checkpoint.

Install only if you are comfortable with a code-review skill that may perform CI remediation and push commits. Before using it, require explicit confirmation for edits, staging, commits, pushes, package installs, npx commands, and GitHub authentication, and prefer reviewing diffs manually before any remote update.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:104
Finding: Repository Changes Can Be Committed and Pushed Without Explicit Approval
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: reference.md:637
Finding: Unpinned Package Retrieval and Execution Through npx
Content: View full analysis
``` ### Technical Analysis The reference guide recommends invoking `bundlephobia` through `npx` without pinning a package version or verifying package integrity. If the command is executed and the package is not already installed locally, `npx` may retrieve the current package from the configured npm registry and execute its CLI code. This introduces a dynamic supply-chain trust boundary into a task that only needs dependency size information. The executed implementation can change after the Skill has been audited because no version, lockfile, integrity hash, or trusted artifact is specified. The command does not establish that the referenced package is malicious. The vulnerability is the unsafe retrieval and execution pattern, which could become exploitable if the registry package, registry configuration, or dependency chain is compromised. ### Attack Path 1. The Agent performs a dependency review using the reference guide. 2. It runs `npx bundlephobia` to inspect a package's bundle size. 3. If the CLI is unavailable locally, `npx` resolves it using the configured package registry. 4. An unpinned package version and its dependency tree are downloaded. 5. The downloaded CLI code executes with the Agent process's local permissions. 6. If the resolved package or dependency is compromised, it can access files, environment variables, network resources, and credentials available to the Agent. ### Impact Assessment A compromised package could execute arbitrary code with the privileges of the user running the Agent. Depending on the environment, potential scope includes: - Reading repository files and local configuration. - Accessing environment variables or locally available credentials. - Modifying project files. - Making outbound network request ...[truncated 227 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad and map to common requests like 'review this' or 'check the code,' making accidental activation likely. Because the skill also contains operational commands and scope expansion beyond pure review, overly broad invocation increases the chance that sensitive repository or PR actions are taken in contexts where the user expected only analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill metadata and instructions are written entirely in Japanese and describe usage in Japanese imperatives, with no indication that the user can choose another language. Under the stated policy, a language or locale constraint should either be optional or explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This skill is presented as a code-review tool, but it instructs the agent to move from analysis into remediation and repository modification when CI fails on the user's own PR. That expands the skill's authority from read-only review into write actions, increasing the chance of unintended code changes or unauthorized workflow execution under a benign-sounding trigger.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Including git add, git commit, and git push in a code-review skill gives the skill direct repository write capability unrelated to its stated purpose. If invoked during a routine review request, the agent could alter branch history or push unintended changes, which is especially risky in privileged or production-connected repositories.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file is a markdown skill/example document, so natural-language policy checks apply. The content begins in Japanese and continues in that language throughout, but it does not state that the skill is Japan-specific or provide any user opt-in or alternative language support, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide states in Japanese that the document provides code review criteria, and the entire skill content is written only in Japanese. For a generally applicable reference guide, this effectively forces a specific language/locale without any opt-in or alternative language option, which matches the language-policy violation criterion.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: reference.md:418