Code Review

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.1.0

Overview

This code-review skill is mostly coherent, but it can commit and push broad repository changes, so users should review it carefully before installing.

Install only if you want a Japanese code-review workflow that can inspect GitHub PR and CI state. Before using it, require explicit approval before any fix, commit, or push; replace `git add .` with staging only named files after reviewing `git status` and the staged diff; and avoid or pin the `npx bundlephobia` command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:103

Finding

Broad Git staging can expose unrelated sensitive files through remote push

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:103-106
Vulnerability Type: Insecure repository mutation and unintended data disclosure
Risk Level: High

Complete Code Snippet:

bash

git add .
git commit -m "fix: resolve CI failures"
git push

Technical Analysis

The Skill instructs the agent to stage the entire working tree with git add ., commit it, and push the commit to the configured remote repository. This stages all changed and untracked files in scope rather than limiting the commit to files deliberately modified while repairing the CI failure.

A code-review or CI-repair workflow does not require indiscriminate access to every working-tree change. The instruction therefore violates least-privilege principles at the data-selection level. Sensitive .env files, private configuration, credentials, generated artifacts, unrelated user work, or attacker-planted files could be included in the commit.

The subsequent git push turns unsafe local staging into a network disclosure risk. Although pushing a repair may be legitimate for a user-owned pull request, doing so without an explicit file allowlist, staged-diff review, secret scan, and user confirmation exceeds the minimum privileges necessary for the declared code-review functionality.

Attack Path

1. A sensitive, unrelated, or attacker-controlled file exists as a changed or untracked file in the repository working tree.
2. The Skill is invoked to diagnose and repair a CI failure on the user's pull request.
3. The agent follows git add ., staging both the intended repair and all other changes in scope.
4. The broad staged set is committed without an explicit staged-diff or secret review.
5. git push transmits the commit to the configured Git remote.
6. Anyone with suitable repository access may retrieve the unintentionally committed data; secrets may remain recoverable from Git history even after a later deletion.

Impa

...[truncated 672 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove git add . from the workflow.
2. Record the exact files intentionally modified by the repair and stage only those explicit paths, for example:

   bash

   git add -- src/affected-file.ts tests/affected-file.test.ts
   

3. Run git status --short before staging and identify unrelated or untracked files.
4. Review the staged patch with:

   bash

   git diff --cached --stat
   git diff --cached
   

5. Run a secret scanner against the staged content before committing.
6. Reject sensitive filenames such as .env, private keys, credential files, and generated secrets by default.
7. Require explicit user confirmation before both git commit and git push.
8. Prefer generating a patch for user review instead of directly mutating and pushing the repository.
9. If exposure has already occurred, remove the data from repository history where appropriate, revoke and rotate affected secrets, and review remote access logs.

T08 · Insecure Dependencies

Warning

• Location: reference.md:637

Finding

Unpinned npx invocation permits third-party code retrieval and execution

Content

View full analysis

Vulnerability Details

File Location: reference.md:637
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

bash

# Alternative package evaluation
npx bundlephobia <package>

Technical Analysis

The reference guide recommends invoking bundlephobia through npx without pinning an exact version or verifying package integrity. If the package is not already available locally, npx can resolve it from the configured package registry, download it, and execute its CLI code.

This creates a supply-chain execution boundary: the code executed during a future Skill run may differ from the content available when the Skill itself was audited. The command does not specify a trusted version, lockfile resolution, integrity hash, or execution sandbox. Package entry-point code and potentially applicable installation behavior execute with the agent user's permissions.

The placeholder argument is not itself shown as being interpolated into a shell command by application code, so command injection is not established. The confirmed issue is unsafe, unpinned remote dependency resolution and execution for a nonessential bundle-size check.

Attack Path

1. The agent follows the dependency-review guidance and invokes npx bundlephobia <package>.
2. npx cannot find a trusted local copy and resolves the package through the configured registry.
3. A compromised release, registry account, dependency, registry mirror, or unexpected package resolution supplies malicious code.
4. npx downloads and executes that code under the agent user's account.
5. The malicious process can access resources available to that account, including repository files and exposed environment variables, and can modify files or initiate network requests.

Impact Assessment

Successfully compromised package code can execute with the same privileges as the user running t ...[truncated 560 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a non-executing, trusted bundle-size lookup mechanism or direct user inspection.
2. If the CLI is required, add it as an audited development dependency and pin an exact version in a committed lockfile.
3. Use a trusted registry and verify package provenance and integrity before adoption.
4. Avoid implicit installation through npx; require the expected local binary and fail if it is absent.
5. Where supported, disable package lifecycle scripts during installation.
6. Execute dependency-analysis tools in a restricted container or sandbox without secrets, unnecessary filesystem access, or broad network access.
7. Require user approval before downloading or executing a package that is not already present and verified.
8. Periodically review the pinned package and its transitive dependencies for vulnerabilities and ownership changes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

起動フレーズが「レビューして」「コードをチェック」「品質を確認」など非常に広く、一般的な依頼と重複しています。そのため、単なる助言や軽い確認のつもりの入力でも本スキルが起動し、CI確認やPR関連操作など想定以上の手順を実行するきっかけになり得ます。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description and operational instructions are written entirely in Japanese and imply the skill is to be used through Japanese trigger phrases, without offering a language choice or documenting a justified locale restriction. This can violate language/locale policy when users have not explicitly opted into Japanese-only behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

このスキルはコードレビュー用途と説明されている一方で、CI失敗時に原因分析だけでなく修正、コミット、pushまで実施するよう指示しています。レビュー専用の権限期待を超えてリポジトリ状態を変更させるため、ユーザーの明示的同意なしに変更実行へ拡張され、破壊的変更や権限逸脱を招く危険があります。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Japanese throughout its instructional content, examples, and review feedback, but it does not indicate that the user can choose another language or that the skill is intentionally limited to a Japanese-speaking context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide is written entirely in Japanese from the outset, beginning with a Japanese-only description, and does not indicate that language selection is optional or that the document is intentionally limited to a Japanese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: reference.md:418