code-review-skill

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward code-review skill that may produce fixes and tests, with no evidence of hidden installation, persistence, credential use, or data exfiltration.

Install this only if you want an agent to inspect staged code changes and suggest or generate fixes and tests. Use it on repositories and diffs you intend to share with the agent, and review any generated changes before applying or committing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill’s trigger/request wording is extremely broad: it asks for a comprehensive review of staged changes in terms that overlap with many normal developer requests. That can cause over-invocation or invocation in unintended contexts, exposing unrelated code or causing the agent to perform expansive review and code-generation actions without clear scope boundaries.

VirusTotal

63/63 vendors flagged this skill as clean.