Security audit

Code Review

Security checks for vulnerabilities and agentic risk

Overview

This code-review skill is mostly transparent about sending reviewed code to AI providers, but its directory scanner can follow symlinks outside the chosen folder and potentially send unintended local files to a configured AI service.

Install only if you are comfortable with the file-access and AI-provider behavior. Use local-only mode for sensitive repositories, avoid running directory review on untrusted repos or repos containing symlinks, and do not treat AI review results as authoritative for security decisions without separate static analysis.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: src/code-review.js:76
Finding: AI Code Review Is Vulnerable to Prompt Injection from Untrusted Source Files
Content: View full analysis
0) { localFindingsText = '\n\nLocal static analysis already detected these issues (incorporate and expand on them):\n'; for (const issue of localIssues) { localFindingsText += `- Line ${issue.line}: [${issue.severity}] ${issue.message}\n`; } } const truncated = code.length > MAX_CODE_CHARS; const codeContent = truncated ? code.substring(0, MAX_CODE_CHARS) + '\n\n... [truncated at 8000 chars]' : code; return `Review the following code from file "${filePath}":${localFindingsText} \`\`\` ${codeContent} \`\`\` Respond with valid JSON only.`; } ``` ### Technical Analysis The application inserts untrusted source-code content directly into the AI model's user prompt. Source files may contain comments, string literals, documentation, or other text that instructs the model to disregard its system prompt, suppress findings, assign an artificially high score, or produce fabricated review results. Markdown code fences are presentational delimiters rather than a security boundary. They do not reliably prevent a language model from interpreting embedded natural-language content as instructions. The returned AI result replaces the local findings in the final response rather than being merged with them. Consequently, successful prompt injection can suppress issues that the local analysis already detected, further increasing the integrity impact. ### Attack Path 1. An attacker adds a comment or string containing adversarial instructions to a source file. 2. A victim runs `CodeReview.review()` or `CodeReview.reviewDir()` with an AI model configured. 3. `_buildUserPrompt()` embeds the attacker-controlled ...[truncated 972 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/code-review.js:386
Finding: Directory Review Follows Symbolic Links and Can Read Files Outside the Scan Root
Content: View full analysis
entry.name === e || entry.name.startsWith('.'))) continue; const full = path.join(dir, entry.name); if (entry.isDirectory()) { this._walk(full, include, exclude, callback); } else if (include.some((p) => entry.name.endsWith(p.replace('*', '')))) { callback(full); } } } catch { // Silently skip directories we can't read } } ``` ### Technical Analysis `fs.readdirSync(..., { withFileTypes: true })` returns symbolic links as directory entries for which `entry.isDirectory()` is false and `entry.isSymbolicLink()` is true. The implementation does not reject such entries. If a symbolic link has a filename matching an allowed suffix, `_walk()` invokes the callback with that path. `review()` subsequently calls `fs.readFileSync()`, which follows the symbolic link and reads its target. There is no `realpath` canonicalization or containment check ensuring that the resolved target remains beneath the directory passed to `reviewDir()`. When an AI provider is configured, the resulting content is passed to `_buildUserPrompt()`, which includes up to 8,000 characters of the file in a request to the selected provider. Thus, the issue can become an external information-disclosure vulnerability. ### Attack Path 1. An attacker prepares a repository con ...[truncated 1445 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The review path sends file contents and locally detected issues to external providers (Anthropic/OpenAI) whenever a model is configured, but there is no consent gate, warning, or data-classification check before transmission. In a code-review skill, the uploaded content may include proprietary source, embedded secrets, internal URLs, or customer data, so silent exfiltration to third-party APIs creates a real confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · README.md (reported line 52)May include surrounding context.
md
**USE AT YOUR OWN RISK.** - The author(s) are NOT liable for any damages, losses, or consequences arising from the use or misuse of this software — including but not limited to financial loss, data loss, security breaches, business interruption, or any indirect/consequential damages. - This software does NOT constitute financial, legal, trading, or professional advice. - Users are solely responsible for evaluating whether this software is suitable for

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
**USE AT YOUR OWN RISK.** - The author(s) are NOT liable for any damages, losses, or consequences arising from the use or misuse of this software — including but not limited to financial loss, data loss, security breaches, business interruption, or any indirect/consequential damages. - This software does NOT constitute financial, legal, trading, or professional advice. - Users are solely responsible for evaluating whether this software is suitable for

Static analysis

No suspicious patterns detected.