ClawHub
Back to skill

Security audit

smart-git

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Git automation skill, but its defaults can approve and merge PRs/MRs automatically and install its CLI globally without asking.

Install only if you are comfortable with Git automation that can mutate repositories. Before using live PR/MR review or batch review, set pullRequestReview.autoApprove=false and pullRequestReview.autoMerge=false or always request dry-run. Use the least-privileged platform token possible, avoid merge-capable tokens unless required, and confirm whether you want the CLI installed globally.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
smart-commit.host-agent.json:62
Finding

PR/MR Reviews Automatically Approve and Merge Changes Without Explicit Authorization

Content
View full analysis

Vulnerability Details

File Location: smart-commit.host-agent.json:62-63
Related Execution Instructions: SKILL.md:348-356, SKILL.md:468-474
Vulnerability Type: Unauthorized repository modification through unsafe defaults
Risk Level: High

Vulnerable Code

json
"pullRequestReview": {
  "threshold": 6,
  "autoApprove": true,
  "autoMerge": true,
  "summarySeverities": ["P0", "P1"],
  "commentSeverities": ["P0", "P1"],
  "skillPromptTuning": "",
  "skipSummaryOnPass": true,
  "skipCommentOnPass": true,
  "configFilePath": ""
}

The corresponding instructions explicitly preserve these defaults for live reviews:

text
Default-config impact (know this before a live review): in the colocated
smart-commit.host-agent.json, pullRequest.provider defaults to auto;
pullRequestReview.autoApprove / autoMerge default to true; summarySeverities
defaults to ["P0","P1"]. So a live pull-request review may auto-approve and
merge after a passing review. When the user has not changed the config:

- Add --dry-run only if the user explicitly asks for dry-run / a trial /
  no publish / no merge
- If the user clearly does not want auto-merge / auto-approve this time:
  pass --set=pullRequestReview.autoMerge=false and/or
  --set=pullRequestReview.autoApprove=false

Batch review uses the same unsafe behavior:

text
Default-config impact (know this before a live batch review): in the
colocated config, pullRequestReview.autoApprove / autoMerge default to true.
Batch items that pass may also be auto-approved and merged.

- Add --dry-run only if the user explicitly asks for dry-run / a trial /
  no publish / no merge

Technical Analysis

The Skill treats a request to review a PR/MR as sufficient authorization to approve and merge it. Approval and merge are materially broader operations than analysis or publication of review comments, but the execution path does not require a separate confirmation or an explicit request to merge.

The defau ...[truncated 1973 chars]

Remediation
View remediation

Remediation Suggestions

  1. Change the shipped defaults to:

    json
    "autoApprove": false,
"autoMerge": false

  2. Require an explicit user request to approve or merge. A request phrased only as “review” must remain read-only or comment-only.

  3. Add a code-enforced confirmation immediately before each approval or merge. Documentation-only guidance is insufficient because the executable path can otherwise proceed with the configured defaults.

  4. Make --dry-run the default for single and batch reviews unless the current request expressly authorizes platform mutations.

  5. Separate review, approval, and merge into distinct authorization gates. For batch workflows, require per-item confirmation or a clearly scoped batch authorization that identifies the repositories and target branches.

  6. Before mutation, display the PR/MR URL, repository, source branch, target branch, review result, and exact actions to be performed.

  7. Apply least-privilege platform tokens so review workflows cannot merge unless merge capability is explicitly required.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (41)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md
Modes that do not need a token: skip the env check below and go straight to config resolve / the business CLI.

Modes that need a token: before config resolve / the business CLI, if SMART_COMMIT_PULL_REQUEST_AUTH_TOKEN is unset or empty: stop immediately; do not guess a token, copy secrets from files/chat, or ask the user to paste a token into the conversation; guide the user to configure SMART_COMMIT_PULL_REQUEST_AUTH_TOKEN (GitHub PAT or GitLab Personal Access Token) so the shell used by the current AI tool can read it. Local Code Review does not need this token.

Permission suggestions (default provider is auto): GitLab api (or enough to create/comment/merge MRs; read_api is enough for List my commits alone); GitHub repo (private repos) or the PR permissions needed for public repos.
After configuring, the user can say create MR / review MR / list my MRs / batch-review my MRs / list my commits again. Do not send the token in the conversation.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Enabling autoApprove and autoMerge allows the agent to make consequential review decisions and merge code changes without a human reviewer validating the result. In a PR/MR workflow, this can directly ship vulnerable, malicious, or policy-noncompliant code into protected branches, especially when the review threshold is model-driven and fallible.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The examples normalize auto-approval as a standard behavior that must be opted out of, which is risky for a tool handling code review and PR/MR workflows. In this context, an LLM-driven review process should not be empowered to finalize governance actions on code changes without an explicit approval gate.

Content

Scanner excerpt · CONFIG.md (reported line 21)May include surrounding context.

md
| You say (examples) | Applied as |
|--------------------|------------|
| review this MR but don't auto-merge this time | pullRequestReview.autoMerge=false |
| don't auto-approve | pullRequestReview.autoApprove=false |
| local review with threshold 8 | review.threshold=8 |
| review this MR with threshold 8 | pullRequestReview.threshold=8 |
| review in English | review.language=en |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The examples normalize auto-approval as a standard behavior that must be opted out of, which is risky for a tool handling code review and PR/MR workflows. In this context, an LLM-driven review process should not be empowered to finalize governance actions on code changes without an explicit approval gate.

Content

Scanner excerpt · CONFIG.md (reported line 21)May include surrounding context.

md
| You say (examples) | Applied as |
|--------------------|------------|
| review this MR but don't auto-merge this time | pullRequestReview.autoMerge=false |
| don't auto-approve | pullRequestReview.autoApprove=false |
| local review with threshold 8 | review.threshold=8 |
| review this MR with threshold 8 | pullRequestReview.threshold=8 |
| review in English | review.language=en |

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented default review.language is "zh-cn", which imposes a specific language for review comments by default. The policy only permits locale constraints when the user is given an explicit choice or the constraint is clearly justified; this file presents English as an optional override rather than an opt-in default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented default commitMessage.language is "zh-cn", meaning auto-generated commit messages will be produced in Chinese unless overridden. This is a natural-language policy concern because it forces a locale-specific output by default instead of offering user choice first.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

Auto-approval is especially dangerous here because it is coupled with auto-merge in the same review workflow, turning the agent into both reviewer and release gate. The skill context makes this more dangerous because it is designed to operate on real PR/MR systems and can take irreversible repository actions.

Content

Scanner excerpt · CONFIG.md (reported line 109)May include surrounding context.

md
| Field | Default | One-line meaning |
|-------|---------|------------------|
| pullRequestReview.threshold | 6 | Only existing PR/MR (including batch) review: score must be strictly greater than this; does not affect local / Create PR/MR |
| pullRequestReview.autoApprove | true | Whether to auto-approve after a passing review |
| pullRequestReview.autoMerge | true | Whether to auto-merge after a passing review (risky) |
| pullRequestReview.summarySeverities | ["P0","P1"] | Which severities are written into the summary comment |
| pullRequestReview.commentSeverities | ["P0","P1"] | Which severities are posted as inline comments |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

Auto-approval is especially dangerous here because it is coupled with auto-merge in the same review workflow, turning the agent into both reviewer and release gate. The skill context makes this more dangerous because it is designed to operate on real PR/MR systems and can take irreversible repository actions.

Content

Scanner excerpt · CONFIG.md (reported line 109)May include surrounding context.

md
| Field | Default | One-line meaning |
|-------|---------|------------------|
| pullRequestReview.threshold | 6 | Only existing PR/MR (including batch) review: score must be strictly greater than this; does not affect local / Create PR/MR |
| pullRequestReview.autoApprove | true | Whether to auto-approve after a passing review |
| pullRequestReview.autoMerge | true | Whether to auto-merge after a passing review (risky) |
| pullRequestReview.summarySeverities | ["P0","P1"] | Which severities are written into the summary comment |
| pullRequestReview.commentSeverities | ["P0","P1"] | Which severities are posted as inline comments |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

Even though the text acknowledges risk, the documented behavior still permits autonomous approval and merge if enabled. That combination is security-relevant because it can transform an advisory analysis tool into an unattended code-integration actor.

Content

Scanner excerpt · CONFIG.md (reported line 308)May include surrounding context.

md
| Field | Type / values | Notes |
|-------|---------------|-------|
| threshold | number, e.g. 6 | Pass when score > threshold. Only remote PR/MR review; changing it does not change review.threshold used by local / Create PR/MR. |
| autoApprove | true / false | Whether to approve on the platform after pass. Set false if you do not want auto-approve. |
| autoMerge | true / false | Whether to auto-merge after pass. Default true is risky; use dry-run for a trial, or set false. |
| summarySeverities | array of P0 / P1 / P2 / P3 | Severities written into the MR summary comment. Default excludes P2. |
| commentSeverities | array of P0 / P1 / P2 / P3 | Severities posted as inline comments. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

Even though the text acknowledges risk, the documented behavior still permits autonomous approval and merge if enabled. That combination is security-relevant because it can transform an advisory analysis tool into an unattended code-integration actor.

Content

Scanner excerpt · CONFIG.md (reported line 308)May include surrounding context.

md
| Field | Type / values | Notes |
|-------|---------------|-------|
| threshold | number, e.g. 6 | Pass when score > threshold. Only remote PR/MR review; changing it does not change review.threshold used by local / Create PR/MR. |
| autoApprove | true / false | Whether to approve on the platform after pass. Set false if you do not want auto-approve. |
| autoMerge | true / false | Whether to auto-merge after pass. Default true is risky; use dry-run for a trial, or set false. |
| summarySeverities | array of P0 / P1 / P2 / P3 | Severities written into the MR summary comment. Default excludes P2. |
| commentSeverities | array of P0 / P1 / P2 / P3 | Severities posted as inline comments. |

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 40)May include surrounding context.

md
## Environment variables

Create PR/MR, Review PR/MR, List my PRs/MRs, Batch-review my PRs/MRs, and List my commits need a platform token. If those modes are unconfigured, the Agent stops and guides you to set SMART_COMMIT_PULL_REQUEST_AUTH_TOKEN.
Local Code Review (bridge with --review-only) and config resolve do not need a token; they can run without it.

Set SMART_COMMIT_PULL_REQUEST_AUTH_TOKEN in an environment loaded at shell startup (macOS / Linux: ~/.zshrc or ~/.bashrc then source; Windows: system env var or the current shell). The shell used by the current AI tool must be able to read it.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The documented out-of-box defaults set pullRequestReview.autoApprove and pullRequestReview.autoMerge to true. That creates a real risk of the agent approving and merging pull requests without meaningful human validation, which can allow vulnerable, malicious, or simply incorrect code to be integrated automatically.

Content

Scanner excerpt · SETUP.md (reported line 61)May include surrounding context.

md
| pullRequest.provider | auto |
| commitMessage.validation.protocol | none |
| commitMessage.scope | forbidden |
| pullRequestReview.autoApprove | true |
| pullRequestReview.autoMerge | true |
| pullRequestReview.summarySeverities | ["P0","P1"] |
| myPullRequest.listScope | account |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CONFIG.md (reported line 173)May include surrounding context.

md
| Repo-level create/review overlay | pullRequestCreation.configFilePath, pullRequestReview.configFilePath (absolute / relative, comma-mixable) |
| Extra short instructions for PR/MR review only | pullRequestReview.skillPromptTuning (overrides review.skill.promptTuning) |
| Whether to create an MR after push | pullRequestCreation.autoCreateAfterPush |
| Disable auto-approve / merge | pullRequestReview.autoApprove / autoMerge to false |
| Include P2 in summaries | add P2 to pullRequestReview.summarySeverities |
| Whether to auto commit/push | git.autoCommit, git.autoPush |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SETUP.md (reported line 93)May include surrounding context.

md
| Repo-level create/review overlay | pullRequestCreation.configFilePath, pullRequestReview.configFilePath (absolute / relative, comma-mixable) |
| Extra short instructions for PR/MR review only | pullRequestReview.skillPromptTuning (overrides review.skill.promptTuning) |
| Whether to create an MR after push | pullRequestCreation.autoCreateAfterPush |
| Disable auto-approve / merge | pullRequestReview.autoApprove / autoMerge to false |
| Include P2 in summaries | add P2 to pullRequestReview.summarySeverities |
| Whether to auto commit/push | git.autoCommit, git.autoPush |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 516)May include surrounding context.

md
| Repo-level create/review overlay | pullRequestCreation.configFilePath, pullRequestReview.configFilePath (absolute / relative, comma-mixable) |
| Extra short instructions for PR/MR review only | pullRequestReview.skillPromptTuning (overrides review.skill.promptTuning) |
| Whether to create an MR after push | pullRequestCreation.autoCreateAfterPush |
| Disable auto-approve / merge | pullRequestReview.autoApprove / autoMerge to false |
| Include P2 in summaries | add P2 to pullRequestReview.summarySeverities |
| Whether to auto commit/push | git.autoCommit, git.autoPush |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 666)May include surrounding context.

md
| Repo-level create/review overlay | pullRequestCreation.configFilePath, pullRequestReview.configFilePath (absolute / relative, comma-mixable) |
| Extra short instructions for PR/MR review only | pullRequestReview.skillPromptTuning (overrides review.skill.promptTuning) |
| Whether to create an MR after push | pullRequestCreation.autoCreateAfterPush |
| Disable auto-approve / merge | pullRequestReview.autoApprove / autoMerge to false |
| Include P2 in summaries | add P2 to pullRequestReview.summarySeverities |
| Whether to auto commit/push | git.autoCommit, git.autoPush |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The default configuration enables autoApprove and autoMerge, meaning the skill is designed to take consequential repository actions automatically after its own review outcome. This crosses from advisory behavior into autonomous decision-making with direct effect on code integration.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
This skill runs independently: it does not call or hand off to other skills.

Behavior is configurable: review threshold, review skill, commit message, Git auto-commit/push, PR/MR platform, assignees/reviewers/labels/milestone/draft, review comments and approve/merge, etc. are all controlled by the colocated smart-commit.host-agent.json. Out-of-box defaults: pullRequest.provider=auto; commitMessage.scope is forbidden; commitMessage.validation.protocol is none; pullRequestReview.autoApprove / autoMerge are true; summarySeverities is ["P0","P1"]; myPullRequest.listScope=account; myCommit.scope=account; myCommit.range=today; pullRequest.remoteHost="" (empty; shared by List / Batch-review / List my commits; if empty, ask before listing against public gitlab.com/github.com for self-hosted GitLab; myPullRequest.remoteHost is a deprecated fallback). Users adapt by editing that file; no skill changes required. A value stated in the request itself ("no auto-merge this time", "threshold 8") overrides the file for that run only (shared prerequisite 4.1). review.skill / commitMessage.skill are host-agent built-in templates, not other agent skills. See [CONFIG.md](CONFIG.md) and [SETUP.md](SETUP.md).

At these times, the Agent should remind the user in one or two sentences that they can edit this config (do not paste the full JSON, do not restate the token):

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CONFIG.md (reported line 173)May include surrounding context.

md
When showing that reminder, write it as a clickable Markdown link using the absolute path of the effective skill directory (SKILL_DIR comes from config resolve / the skill copy read this turn), for example:

    Tip: edit [smart-commit.host-agent.json]({SKILL_DIR}/smart-commit.host-agent.json) to adjust the review threshold, review skill, commit message, Git flow (auto-stage/commit/push), auto-approve/merge, assignees/reviewers, and more. See [CONFIG.md]({SKILL_DIR}/CONFIG.md) for field docs.

Keep the [filename]({SKILL_DIR}/...) structure at the end of each mode summary so the files are clickable; do not use a bare filename or a backtick-wrapped filename only.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SETUP.md (reported line 51)May include surrounding context.

md
When showing that reminder, write it as a clickable Markdown link using the absolute path of the effective skill directory (SKILL_DIR comes from config resolve / the skill copy read this turn), for example:

    Tip: edit [smart-commit.host-agent.json]({SKILL_DIR}/smart-commit.host-agent.json) to adjust the review threshold, review skill, commit message, Git flow (auto-stage/commit/push), auto-approve/merge, assignees/reviewers, and more. See [CONFIG.md]({SKILL_DIR}/CONFIG.md) for field docs.

Keep the [filename]({SKILL_DIR}/...) structure at the end of each mode summary so the files are clickable; do not use a bare filename or a backtick-wrapped filename only.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SETUP.md (reported line 93)May include surrounding context.

md
When showing that reminder, write it as a clickable Markdown link using the absolute path of the effective skill directory (SKILL_DIR comes from config resolve / the skill copy read this turn), for example:

    Tip: edit [smart-commit.host-agent.json]({SKILL_DIR}/smart-commit.host-agent.json) to adjust the review threshold, review skill, commit message, Git flow (auto-stage/commit/push), auto-approve/merge, assignees/reviewers, and more. See [CONFIG.md]({SKILL_DIR}/CONFIG.md) for field docs.

Keep the [filename]({SKILL_DIR}/...) structure at the end of each mode summary so the files are clickable; do not use a bare filename or a backtick-wrapped filename only.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
When showing that reminder, write it as a clickable Markdown link using the absolute path of the effective skill directory (SKILL_DIR comes from config resolve / the skill copy read this turn), for example:

    Tip: edit [smart-commit.host-agent.json]({SKILL_DIR}/smart-commit.host-agent.json) to adjust the review threshold, review skill, commit message, Git flow (auto-stage/commit/push), auto-approve/merge, assignees/reviewers, and more. See [CONFIG.md]({SKILL_DIR}/CONFIG.md) for field docs.

Keep the [filename]({SKILL_DIR}/...) structure at the end of each mode summary so the files are clickable; do not use a bare filename or a backtick-wrapped filename only.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The skill instructs the agent to globally install a package automatically without asking the user when no existing CLI is found. Automatic installation is a state-changing action that can introduce supply-chain risk, modify the host environment, and violate least surprise, especially in enterprise or restricted systems.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md
#### 2.3 When nothing is found: default automatic global install

Run only when 2.2 missed all candidates (do not ask the user whether to install): globally install package smart-commit-host-agent.
After install, re-check the global command on PATH (exists, version, help). If recheck passes and subcommands are complete, prefix is smart-commit-host-agent; note auto global install this turn, then continue. Recheck fails: go to 2.4.

Forbidden: forcing a global install when 2.2 already found a usable CLI; forging an unverified path after a failed install; hiding an install failure; using elevated privileges for global install unless the user explicitly asked this turn.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The cited behavior exposes the same underlying issue: default live review behavior includes approval and merge actions without requiring explicit confirmation. That makes repository mutation a side effect of a nominal review request.

Content

Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.

md
Must have at least one PR/MR URL (GitHub .../pull/N or GitLab .../merge_requests/N). No URL: ask.

Default-config impact (know this before a live review): in the colocated smart-commit.host-agent.json, pullRequest.provider defaults to auto; pullRequestReview.autoApprove / autoMerge default to true; summarySeverities defaults to ["P0","P1"]. So a live pull-request review may auto-approve and merge after a passing review. When the user has not changed the config:

- Add --dry-run only if the user explicitly asks for dry-run / a trial / no publish / no merge
- If the user clearly does not want auto-merge / auto-approve this time: pass --set=pullRequestReview.autoMerge=false and/or --set=pullRequestReview.autoApprove=false (4.1); for a permanent change point them at the JSON

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The cited behavior exposes the same underlying issue: default live review behavior includes approval and merge actions without requiring explicit confirmation. That makes repository mutation a side effect of a nominal review request.

Content

Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.

md
Must have at least one PR/MR URL (GitHub .../pull/N or GitLab .../merge_requests/N). No URL: ask.

Default-config impact (know this before a live review): in the colocated smart-commit.host-agent.json, pullRequest.provider defaults to auto; pullRequestReview.autoApprove / autoMerge default to true; summarySeverities defaults to ["P0","P1"]. So a live pull-request review may auto-approve and merge after a passing review. When the user has not changed the config:

- Add --dry-run only if the user explicitly asks for dry-run / a trial / no publish / no merge
- If the user clearly does not want auto-merge / auto-approve this time: pass --set=pullRequestReview.autoMerge=false and/or --set=pullRequestReview.autoApprove=false (4.1); for a permanent change point them at the JSON

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Single PR/MR review mode permits live reviews to auto-approve and auto-merge after a passing review under the default configuration. Because the workflow does not require an affirmative user confirmation at invocation time, a routine 'review PR' request can trigger irreversible repository actions beyond analysis.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:175

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:111