Security audit

Cody

Security checks for vulnerabilities and agentic risk

Overview

This code review skill mostly matches its stated purpose, but it can read local repository diffs and use GitHub/GitLab tokens to fetch PR data without clear host scoping or confirmation.

Review this before installing if you work with private repositories or have GITHUB_TOKEN/GITLAB_TOKEN in your environment. Use it only on repositories and PR/MR URLs you trust, and avoid letting it fetch GitLab MRs from arbitrary hosts unless you intend to send your GitLab token there.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: 该技能文档明确要求运行本地脚本获取 PR diff 和 Git diff，意味着其具备 shell、network 和可能读取环境变量的能力，但未声明任何权限边界或用户确认机制。这样的隐式能力会让调用方低估其数据访问范围，导致仓库内容、远程 PR 数据或凭据相关上下文在未经充分告知的情况下被访问。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: 技能宣称会执行完整代码审查、严格程度控制、多语言规则和多格式报告，但文档实际可操作部分主要是抓取 diff，存在明显的能力与描述不一致。此类误导会让用户把输出当作安全审计或质量门禁依据，从而对并不存在的分析能力产生错误信任，导致漏洞漏检或错误决策。

Vague Triggers

Medium

Confidence: 82% confidence
Finding: 触发示例包含“检查这段代码”“看看这个 diff 有没有问题”“代码审查”等较宽泛表达，容易在普通对话或非预期场景中误触该技能。一旦被自动触发，技能可能进一步执行本地 diff/PR 拉取等高权限操作，扩大数据暴露和越权执行风险。

Vague Triggers

Medium

Confidence: 83% confidence
Finding: 标准模式的触发词如“review / 代码审查 / 检查代码”过于宽泛，容易与普通用户请求重叠，从而在未明确确认的情况下自动进入包含安全审查的模式。对一个会处理外部 diff、PR 内容和代码片段的技能来说，模糊触发规则会造成行为不可预测，可能被输入措辞操纵，导致审查深度、输出内容或自动化流程偏离用户真实意图。

Vague Triggers

Medium

Confidence: 87% confidence
Finding: 严格模式包含“全面检查”“PR review”等过于泛化的触发词，极易被常见开发请求意外命中。由于严格模式会扩大检查范围并可能影响 CI 门禁、审查结论和工作流决策，模糊触发会让外部输入间接控制安全/质量策略，增加提示注入式操控和误分类风险。

Static analysis

No suspicious patterns detected.