Autoreview

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 1.0.0

Overview

This is a coherent code-review helper, but it can send broad local repository content to external AI reviewers and includes an opt-in raw shell command path for parallel tests.

Install only if you are comfortable with this helper sending selected repository diffs, untracked local files, optional datasets, and prompt files to configured AI review tools. Avoid running it in repositories with secrets or private data unless files are ignored or removed first, consider using --no-web-search where possible, and use --parallel-tests only with commands you explicitly trust.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/autoreview:360

Finding

Untracked sensitive files may be disclosed to external AI review providers

Content

View full analysis

str: parts = [ "# Git Status", git(repo, "status", "--short"), "# Staged Diff", git(repo, "diff", "--cached", "--stat"), bounded(git(repo, "diff", "--cached", "--patch", "--find-renames")), "# Unstaged Diff", git(repo, "diff", "--stat"), bounded(git(repo, "diff", "--patch", "--find-renames")), ] untracked = [line for line in git(repo, "ls-files", "--others", "--exclude-standard").splitlines() if line] if untracked: parts.append("# Untracked Files") for rel in untracked: path = repo / rel parts.append(f"## {rel}\n{read_text(path)}") return "\n\n".join(parts) ``` The collected bundle is subsequently interpolated into the prompt at `scripts/autoreview:443-471` and passed to the selected Codex, Claude, Droid, or Copilot CLI at `scripts/autoreview:482-632`. ### Technical Analysis In local review mode, `local_bundle()` enumerates every untracked, non-ignored file using: ```bash git ls-files --others --exclude-standard ``` Each text file is then read with `read_text()` and included in the review prompt. There is no sensitive-file denylist, source-file allowlist, secret scanner, content redaction, or confirmation step before the prompt is supplied to an AI reviewer. Although transmitting a patch to an AI provider is consistent with the declared review functionality, collecting every untracked text file exceeds the minimum data access required to review changed source code. Untracked files can include `.env` files, access tokens, private configuration, credentials, customer data, local notes, or proprietary artifacts. Git-ignored files are excluded, but this is insufficient because sensi ...[truncated 1680 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/autoreview:443

Finding

Untrusted patch content is exposed to tool-enabled reviewers without a prompt-injection boundary

Content

View full analysis

str: target_line = f"{target} {target_ref}" if target_ref else target return textwrap.dedent( f""" You are a senior code reviewer. Review the provided git change bundle only. Hard rules: - Return exactly one JSON object and nothing else. Do not wrap it in Markdown. - The JSON object must match this schema exactly: {json.dumps(SCHEMA, indent=2)} - Do not modify files. - Do not invoke nested reviewers or review tools. - Forbidden nested review commands include: codex review, autoreview, claude review, oracle review. - You may use read-only tools and web search to inspect files, dependency contracts, upstream docs, current behavior, and security implications. - Shell commands, if available, must be read-only inspection commands. Do not run tests, formatters, package installs, generators, network mutation commands, git mutation commands, or commands that write files. - Report only actionable defects introduced or exposed by this change. - Prefer high-signal findings over style feedback. - Include security findings: injection, secret leaks, authz/authn bypass, path traversal, unsafe deserialization, unsafe filesystem or shell use, privacy leaks, and credential handling. - Do not reject legitimate functionality merely because it touches shell, filesy ...[truncated 4780 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The --parallel-tests option accepts arbitrary command text and passes it to a shell or PowerShell interpreter for execution. In an agent skill, this is a real command-execution primitive that can be triggered with attacker-influenced input, leading to arbitrary code execution, file modification, data exfiltration, or persistence on the local machine.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate finding points to the same shell invocation sink: the parallel test command is run with shell=True, enabling arbitrary command execution. In the context of a closeout review skill, this capability is out of scope and turns a review helper into a local execution mechanism.

Content

Scanner excerpt · scripts/autoreview (reported line 951)May include surrounding context.

text

def start_parallel_tests(command: str, repo: Path, shell_kind: str) -> tuple[subprocess.Popen, float]:
    print(f"tests: {command}")
    if shell_kind == "default" or shell_kind == "cmd":
        return subprocess.Popen(command, cwd=repo, shell=True), time.time()
    if shell_kind == "powershell":
        powershell = resolve_command("powershell", repo)
        return subprocess.Popen(

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate finding points to the same shell invocation sink: the parallel test command is run with shell=True, enabling arbitrary command execution. In the context of a closeout review skill, this capability is out of scope and turns a review helper into a local execution mechanism.

Content

Scanner excerpt · scripts/autoreview (reported line 951)May include surrounding context.

text

def start_parallel_tests(command: str, repo: Path, shell_kind: str) -> tuple[subprocess.Popen, float]:
    print(f"tests: {command}")
    if shell_kind == "default" or shell_kind == "cmd":
        return subprocess.Popen(command, cwd=repo, shell=True), time.time()
    if shell_kind == "powershell":
        powershell = resolve_command("powershell", repo)
        return subprocess.Popen(

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/test-review-harness.py (reported line 56)May include surrounding context.

python

}

export function deleteUpload(name) {
  return execSync(`rm -rf uploads/${name}`);
}

export function publicUser(user) {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to invoke shell-based helper scripts, read repository state, inspect PR metadata via gh, and potentially use datasets/prompt files, but it declares no permissions or allowed-tools scope. That creates an implicit trust boundary failure: a host may grant broader file, env, or shell access than is actually required, increasing the blast radius if the skill is misused or if downstream helper behavior changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The only user-facing indication before execution is printing the command string, which is not a meaningful security control in an automated or agent-driven workflow. Users may assume the skill is review-only based on metadata, so silent escalation into shell execution materially increases the chance of unsafe command execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script is presented as a code-review helper, but it also executes a caller-supplied command via the parallel test feature. That creates a broader capability than the skill description suggests, and in an agent context this can be abused to run arbitrary local commands under the user's privileges rather than merely reviewing code.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test-review-harness.py (reported line 134)May include surrounding context.

python

def run(command: list[str], cwd: Path) -> None:
    subprocess.run(command, cwd=cwd, check=True)


def create_fixture_repo(repo: Path, fixture: str) -> None:

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test-review-harness.py:56