Security audit

code-review-and-qual

Security checks across malware telemetry and agentic risk

Overview

This skill looks like a code-review helper, but it grants command execution and describes broad automation, API, and credential workflows without clear limits.

Review before installing. Use only in a contained environment and do not provide production credentials or sensitive repositories unless the publisher narrows the skill to explicit code-review actions, documents any commands it may run, and explains API/data handling clearly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill is advertised as a code-review capability, but the body describes generic data processing and orchestration functions instead. This mismatch can mislead users and host agents about what the skill will actually do, increasing the chance of unsafe invocation, scope creep, and unintended access to broader capabilities than expected.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The FAQ and safety sections claim capabilities such as encryption, API integration, and custom rule systems without evidence elsewhere in the skill definition. Unsupported security and integration claims create false assurance, which can cause users to trust the skill with sensitive code or credentials under incorrect assumptions.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill’s stated purpose is code review, but its manifest broadens scope to generic automation, data analysis, workflow orchestration, API use, network connectivity, and command execution. This is dangerous because a narrowly trusted review skill could be used as a vehicle for broader system actions, violating least privilege and increasing the attack surface significantly.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Granting command execution to a skill whose declared function is code review is unjustified and materially increases risk. If invoked on untrusted repositories or prompted by ambiguous instructions, the skill could execute local commands, inspect sensitive files, or become a pivot for harmful actions unrelated to review.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger condition says the skill activates whenever a user needs related operations, which is overly broad and ambiguous. Ambiguous invocation rules increase the chance that agents will call the skill in inappropriate contexts, especially given its declared exec and API-oriented capabilities.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The description uses broad language about development automation and orchestration without clear scope constraints. In context, this makes the skill more dangerous because it encourages expansive use of a skill that also advertises command execution and external/API interactions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The manifest exposes command execution capability but does not provide a clear, prominent user warning in the markdown. Users may reasonably trust a code-review skill as read-only, so omitting this warning can lead to unsafe use on sensitive environments or repositories.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The onboarding steps instruct users to configure API keys and establish API connections, but the skill does not clearly warn about network transmission, credential handling, or data exposure. This can cause users to provide secrets or send source code externally without informed consent or clear boundaries.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.