ClawHub
Back to skill

Security audit

Code Review

Security checks across malware telemetry and agentic risk

Overview

This is mostly a code-review guide, but it also tells an agent to fix, commit, and push code for failed PR checks, which deserves user review before installation.

Install only if you are comfortable with a review skill that may inspect GitHub PR and CI state and contains instructions to fix, commit, and push changes on your own PRs. Use explicit prompts for read-only review when that is what you want, and require confirmation before any commit, push, dependency update, or CI-remediation action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The skill is described as a code-review tool, but these instructions expand its behavior into making code changes, committing them, and pushing to a remote when CI fails on the user's own PR. That crosses from analysis into repository mutation, which can cause unauthorized or unintended changes, especially if the skill is auto-invoked during normal review requests.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
These instructions tell the agent to analyze CI failures and proceed toward fixing them rather than only reviewing and summarizing issues. In a review-context skill, this broadens authority from passive assessment to active intervention, increasing the chance of unintended code changes or actions beyond what a user expects from a review request.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation phrases are very broad (e.g. generic requests to review or check code), making it easy for this skill to trigger in ordinary development conversations. Because the skill also contains action-oriented CI and PR instructions, broad triggering increases the likelihood that higher-risk behavior is invoked in contexts where the user only expected analysis.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
reference.md:418