Security audit

code-review-and-qual

Security checks for vulnerabilities and agentic risk

Overview

This code-review skill is not overtly malicious, but it requests command execution and describes broad automation, API, and file workflows without clear limits or data-flow disclosure.

Install only if you are comfortable granting a broadly scoped code-review assistant read and command-execution authority. Treat the encryption, GitHub verification, and API-safety claims as unsubstantiated, and avoid using it on proprietary repositories or secrets unless the publisher documents exact commands, external data flows, and consent boundaries.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as a code-review utility, but the text broadens its scope to generic automation, data analysis, workflow orchestration, API access, command execution, and file handling. That scope mismatch is dangerous because users may invoke it expecting low-risk analysis behavior while the skill is framed broadly enough to justify higher-risk actions affecting the host system or external services.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation guidance is so broad that the skill could trigger for vaguely related user requests, increasing the chance that risky capabilities are used outside their intended context. For a skill advertising exec, API, and file-oriented behavior, ambiguous triggering materially raises the likelihood of inappropriate access or unintended data handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The mixed-language, broad invocation guidance obscures the real scope of the skill and makes it difficult for users or platforms to determine when it should run. This ambiguity is risky because it can mask elevated behaviors behind a benign code-review label and weaken operator scrutiny.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Declaring exec capability for a skill whose primary purpose is code review violates least privilege and creates a path for system-impacting behavior unrelated to reviewing code quality. If the skill later incorporates user-controlled inputs into commands, this permission can enable command injection, data exfiltration, or unintended local modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation references command execution and file operations but does not prominently warn users that the skill may affect the local system or process potentially sensitive files. Absent clear disclosure, users may treat the skill as read-only analysis and unintentionally authorize dangerous actions or expose data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document asserts trust-enhancing properties such as GitHub-source verification and data accuracy/traceability without providing any concrete mechanism, constraints, or implementation details. In a skill that also advertises exec and API/network-related behavior, unsupported security/integrity claims can mislead users into granting excessive trust and sending sensitive code or credentials to the skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The FAQ claims encryption protects user data, but the artifact contains only generic prose and no implementation, configuration, or boundary statements showing where encryption applies. Such unsupported security claims can cause users to submit proprietary code, secrets, or internal data under false assumptions about confidentiality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The setup instructions mention API keys, external API calls, and network activity without clearly warning that user code, repository content, or metadata may be transmitted to third-party services. In a code-review context, this can expose proprietary source code, credentials embedded in code, or other sensitive development artifacts to external systems unexpectedly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.