Security audit

Modified Code Review

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent code-review skill that reads code changes for review and does not install code, persist state, or perform hidden actions.

Before installing, expect the skill to inspect the code changes in your current repository when you ask for a review. For best results and tighter privacy control, provide a specific diff, PR, or file list instead of relying on automatic scope detection.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The file title, description, and usage instructions are entirely in Chinese, and line 15 instructs the skill to output a specific report format without indicating that users may choose another language. This can amount to a language-policy issue when the skill implicitly forces a locale without user opt-in or justification.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill advertises broad activation phrases like 'review my modified code', 'code review', 'best practices', and 'code score' without tight boundaries on when it should activate. This can cause the skill to trigger on generic requests and override more appropriate skills or workflows, increasing the chance of unintended data exposure or mis-scoped analysis in security-sensitive contexts.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill description uses broad trigger phrases such as “代码评审” and “代码评分” without clearly requiring concrete inputs like a diff, PR, or modified files. This can cause the skill to activate for general discussion requests and steer the assistant into an unintended review workflow, increasing prompt-selection errors and reducing response relevance.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger section mixes specific conditions with ambiguous phrases like “审查修改” and “最佳实践方案,” but does not define minimum required inputs or exclusions. In a skill-routing context, this ambiguity can over-match ordinary advisory requests, causing the wrong skill to run and potentially leading the assistant to inspect local repo state unnecessarily.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The tagline and description force a specific language/locale in the skill’s natural-language metadata, which can violate language-choice policy when no opt-in or alternative is offered. Nothing in the file indicates that the skill is region-specific or that users can choose another language.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: Language/locale policy applies to all file types. Even though the wording is permissive rather than absolute, the skill overall is Chinese-centric and does not state that output language should follow the user's preference, which risks an implicit locale bias without opt-in.

Static analysis

No suspicious patterns detected.