Skills reviewdog

📦

reviewdog

Name: reviewdog
Author: AgentSecOps

v0.1.0 Content revision r2 Critical 📁 Filesystem access🔑 Env variables🌐 Network access⚡ Contains scripts⚙️ External commands

Integrate Reviewdog Security Feedback into CI

Security scanner results are often fragmented across CI logs. This skill helps configure reviewdog to publish focused findings in pull requests and local hooks.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "reviewdog" from https://skillstore.io/skills/agentsecops-reviewdog.md and its manifest at https://skillstore.io/api/skills/agentsecops-reviewdog/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-reviewdog.md Signed manifest GET /api/skills/agentsecops-reviewdog/manifest Signed lockfile GET /api/skills/agentsecops-reviewdog/lockfile

Test it

Using "reviewdog". Configure Bandit for local Python review.

Expected outcome:

A local reporter configuration for Bandit findings.
A changed-line filter and blocking error threshold.
Required reviewdog and Bandit installation steps.

Using "reviewdog". Add Semgrep and Gitleaks to GitHub pull requests.

Expected outcome:

A pull request workflow with minimal write permissions.
Separate critical and warning review channels.
Pinned dependencies and fail-closed scanner handling.

Using "reviewdog". Integrate a custom scanner with reviewdog.

Expected outcome:

A format selection, field mapping, reporter choice, severity policy, and validation checklist for the custom scanner.

Security Audit

Critical

v9 • 7/23/2026 Open versioned report

Most static alerts are false positives caused by Markdown code spans, documentation URLs, /dev/null redirection, and references to platform-managed CI tokens. The GitLab template critically downloads a mutable remote installer and pipes it directly to sh. The templates also use predictable temporary files, unpinned CI dependencies, and fail-open secret-scanning patterns.

Files scanned

2,206

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

assets/gitlab_ci_template.yml:14

Pipe to shell pattern

curl -sfL https://raw.githubusercontent.com/reviewdog/reviewdog/master/install.sh | sh -s -- -b /usr

The CI template downloads an installer from the mutable master branch and immediately executes it with sh. A compromised upstream response would gain code execution in the runner.

High

assets/github_actions_template.yml:24-27 assets/github_actions_template.yml:35-37

Mutable CI Dependencies Execute in a Privileged Workflow

The GitHub workflow uses a mutable major action tag, requests the latest reviewdog release, and installs unpinned Python packages. Upstream changes can execute before later steps receive a write-capable GitHub token.

The mutable action tag, latest version selector, and unpinned package installation are explicit. The workflow also grants pull-request and checks write permissions.

High

assets/.reviewdog.yml:38-46 assets/github_actions_template.yml:79-99 assets/gitlab_ci_template.yml:67-86 assets/pre_commit_config.yaml:37-45

Critical Secret Scans Fail Open

Gitleaks failures are suppressed with true, and missing reports can produce empty findings or skip reviewdog. Scanner crashes can therefore pass the critical secret gate.

Each configuration explicitly suppresses the Gitleaks exit status. At least one path substitutes empty findings or skips review processing when output is absent.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

assets/gitlab_ci_template.yml:14

Hardcoded URL

curl -sfL https://raw.githubusercontent.com/reviewdog/reviewdog/master/install.sh | sh -s -- -b /usr

This URL targets a mutable master-branch installer that is fetched during CI and passed directly to sh. The network dependency is not pinned or integrity-verified.

Medium

assets/.reviewdog.yml:41

Temp directory access

gitleaks detect --report-format json --report-path /tmp/gitleaks.json --no-git 2>/dev/null || true

Gitleaks writes sensitive scan output to the predictable shared path /tmp/gitleaks.json. On a shared host, collisions or symlink attacks could overwrite another file or expose findings.

Medium

assets/.reviewdog.yml:42

Temp directory access

cat /tmp/gitleaks.json 2>/dev/null || echo '{"findings":[]}'

The runner reads scan results from the predictable shared path /tmp/gitleaks.json. A colliding or attacker-controlled file could be accepted as trusted scanner output.

Medium

assets/pre_commit_config.yaml:42

Temp directory access

entry: bash -c 'gitleaks detect --report-format json --report-path /tmp/gitleaks.json --no-git 2>/de

The pre-commit hook writes and reads Gitleaks results at the fixed shared path /tmp/gitleaks.json. This permits collisions and symlink manipulation on multi-user systems.

Risk Factors

📁 Filesystem access (34)

🔑 Env variables (17)

assets/github_actions_template.yml:43 assets/github_actions_template.yml:56 assets/github_actions_template.yml:70 assets/github_actions_template.yml:82 assets/github_actions_template.yml:105 assets/github_actions_template.yml:121 assets/github_actions_template.yml:139 references/cwe_mapping.md:304 references/cwe_mapping.md:331 references/reporter_formats.md:46 references/reporter_formats.md:62 references/reporter_formats.md:159 references/reporter_formats.md:403 references/reporter_formats.md:417 SKILL.md:63 SKILL.md:116 SKILL.md:313

🌐 Network access (19)

assets/gitlab_ci_template.yml:14 assets/pre_commit_config.yaml:69 assets/pre_commit_config.yaml:81 assets/pre_commit_config.yaml:88 references/reporter_formats.md:71 references/reporter_formats.md:139 references/reporter_formats.md:245 references/reporter_formats.md:279 references/reporter_formats.md:295 references/supported_tools.md:421 references/supported_tools.md:435 SKILL.md:6 SKILL.md:20 SKILL.md:21 SKILL.md:381 SKILL.md:382 SKILL.md:383 SKILL.md:384 SKILL.md:385

⚡ Contains scripts (2)

references/cwe_mapping.md:83 SKILL.md:271

⚙️ External commands (49)

references/reporter_formats.md:331 SKILL.md:45-54 SKILL.md:54-58 SKILL.md:58-66 SKILL.md:66-74 SKILL.md:74-83 SKILL.md:83-101 SKILL.md:101-125 SKILL.md:125-128 SKILL.md:128-139 SKILL.md:139-145 SKILL.md:145-157 SKILL.md:157-178 SKILL.md:178-191 SKILL.md:191-192 SKILL.md:192-197 SKILL.md:197-199 SKILL.md:199-200 SKILL.md:200-202 SKILL.md:202-204 SKILL.md:204-205 SKILL.md:205-206 SKILL.md:206-208 SKILL.md:208-210 SKILL.md:210-211 SKILL.md:211-212 SKILL.md:212-213 SKILL.md:213-221 SKILL.md:221-235 SKILL.md:235-241 SKILL.md:241-251 SKILL.md:251-257 SKILL.md:257-263 SKILL.md:263-269 SKILL.md:269-277 SKILL.md:277-312 SKILL.md:312 SKILL.md:313 SKILL.md:320-321 SKILL.md:321-322 SKILL.md:322-328 SKILL.md:328-337 SKILL.md:337-339 SKILL.md:339-343 SKILL.md:343-345 SKILL.md:345-364 SKILL.md:364-370 SKILL.md:370-377 SKILL.md:222

Detected Patterns

Pipe to shell pattern

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentsecops-reviewdog/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-reviewdog/security.svg)](https://skillstore.io/skills/agentsecops-reviewdog?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-reviewdog?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-reviewdog/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-reviewdog.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). reviewdog security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-reviewdog/audits/9

BibTeX citation

@techreport{agentsecops-agentsecops-reviewdog-2026,
  author = {AgentSecOps},
  title = {reviewdog security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/agentsecops-reviewdog/audits/9},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "reviewdog security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
  - name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-reviewdog/audits/9"
identifiers:
  - type: other
    value: "skillstore:agentsecops-reviewdog:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add Pull Request Security Comments

Publish Bandit and Semgrep findings on changed lines in GitHub pull requests.

Standardize GitLab Security Gates

Combine multiple scanners into consistent merge request discussions and blocking thresholds.

Run Local Pre-Commit Reviews

Surface security and lint findings before code reaches the remote repository.

Try These Prompts

Create a Basic Local Setup

Configure reviewdog for [language] using [scanner]. Use the local reporter, scan changed files, and explain required dependencies.

Add a GitHub Actions Review

Create a GitHub Actions reviewdog workflow for [scanners]. Use least-privilege permissions, pinned dependencies, and pull request annotations.

Build a GitLab Security Gate

Design a GitLab CI reviewdog pipeline for [scanners]. Block [severity] findings and report lower severities without suppressing scanner failures.

Design a Multi-Tool Policy

Create a reviewdog policy for [repository]. Define reporters, diff filters, severity mappings, failure behavior, token permissions, and verified dependency versions.

Best Practices

Pin actions, packages, installers, and container images to reviewed immutable versions.
Grant reporter tokens only the repository permissions required for comments and checks.
Fail closed when a critical scanner crashes or produces an invalid report.

Avoid

Do not pipe remote installation scripts directly into a shell.
Do not suppress every scanner error with unconditional success handling.
Do not expose broad write tokens to unpinned tools or untrusted pull request workflows.