The audit found no evidence of malicious prompt injection, credential exfiltration, or hidden execution. The static alerts are caused by Markdown code examples, CI snippets, tool names, secret placeholder references, and a CWE link. The CI examples still require normal approval, least-privilege credentials, and human validation before use.
The audit found no evidence of malicious prompt injection, credential exfiltration, or hidden execution. The static alerts are caused by Markdown code examples, CI snippets, tool names, secret placeholder references, and a CWE link. The CI examples still require normal approval, least-privilege credentials, and human validation before use.
Static analysis reported extensive command, secret, filesystem, and network indicators, but review found these are in documentation and example automation snippets. No malicious intent or prompt injection attempt was found, but the skill should publish with warnings because users may execute scanners, CI commands, and API-backed review workflows.
1
Files scanned
451
Lines analyzed
7
Review items
1
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill includes runnable examples for scanners and shell pipelines. This is legitimate for code review, but users should approve commands before execution.
The commands are visible inside examples for TruffleHog, SonarQube, CodeQL, Semgrep, and Python subprocess calls. They support the stated workflow, but execution can affect local repositories or CI environments.
The example CI and Python orchestrator read OpenAI, GitHub, and Anthropic credentials from environment variables. This is expected, but requires careful secret handling.
The environment variable access is explicit and tied to normal API authentication. I found no evidence that the skill exfiltrates or logs the credential values.
Static Heuristic Combination Is Mostly Documentation
The dangerous combination finding is a false positive for malicious intent. The indicators appear in fenced examples, checklists, and review templates.
The suspicious patterns are shown as instructional examples for a code review skill. I found no hidden loader, obfuscation, unauthorized endpoint, or instruction to bypass security review.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Weak Crypto And Windows SAM Hits Are False Positives
The weak cryptography and Windows SAM findings match incidental text in examples and prose. No cryptographic implementation or SAM database access is present.
The cited lines contain metadata, prompt configuration, and SQL injection review text. I found no file access to Windows SAM and no implemented weak cryptographic algorithm.
All 53 static findings are false positives. The skill is a legitimate code review assistant that integrates security scanning tools (SonarQube, CodeQL, Semgrep, TruffleHog) with AI models. External commands, environment access, and network calls are all required for its core function of automated code analysis and GitHub integration.
The skill contains examples of running static analysis tools (sonar-scanner, semgrep, codeql) via subprocess. These are hardcoded tool invocations required for code review functionality - not user input injection vectors.
Subprocess calls are hardcoded with tool names, repository variable is internal constructor input, not untrusted user data
Accesses GITHUB_TOKEN and ANTHROPIC_API_KEY environment variables. These are required for authenticating with GitHub API to post review comments and Claude API for AI analysis.
Standard API authentication pattern for legitimate GitHub and Claude integration