Versioned security assessment

Report ID: SA-3D15A301

2/25/2026, 6:47:40 AM

code-review-ai-ai-review security assessment v1

Skill Security Certification Report

Audit History
Audit model: claude Historical report
Skill name
code-review-ai-ai-review
Version
v1
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/code-review-ai-ai-review
Coverage
1 Files scanned · 453 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Low

6 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

All 53 static findings are false positives. The skill is a legitimate code review assistant that integrates security scanning tools (SonarQube, CodeQL, Semgrep, TruffleHog) with AI models. External commands, environment access, and network calls are all required for its core function of automated code analysis and GitHub integration.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 453 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Not recorded by this audit

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Low
SKILL.md:369SKILL.md:372
External Command Execution
The skill contains examples of running static analysis tools (sonar-scanner, semgrep, codeql) via subprocess. These are hardcoded tool invocations required for code review functionality - not user input injection vectors.
Subprocess calls are hardcoded with tool names, repository variable is internal constructor input, not untrusted user data
RISK-002 Low
SKILL.md:361SKILL.md:362
Environment Variable Access
Accesses GITHUB_TOKEN and ANTHROPIC_API_KEY environment variables. These are required for authenticating with GitHub API to post review comments and Claude API for AI analysis.
Standard API authentication pattern for legitimate GitHub and Claude integration
RISK-003 Low
SKILL.md:285
Network Request to External URL
Contains a reference URL to cwe.mitre.org for vulnerability documentation. This is a documentation link, not a data exfiltration endpoint.
Static reference URL for Common Weakness Enumeration documentation
RISK-004 Low
SKILL.md:324
File System Operations
Reads review-comments.json file to post comments via GitHub API. Standard file I/O for workflow automation.
Local file read for reading generated review data, not arbitrary file access
RISK-005 Low
SKILL.md:190-197
Secret Detection Tools
Shows integration with TruffleHog for secret scanning. This is a defensive security tool to DETECT leaked secrets, not to exfiltrate them.
TruffleHog is a well-known open source secret detection tool used for defensive security
RISK-006 Low
SKILL.md:3SKILL.md:61
Weak Cryptographic Algorithm References
Mentions MD5 and SHA-1 in OWASP Top 10 context as vulnerabilities to DETECT (e.g., weak password hashing), not as algorithms the skill uses.
Documentation of security vulnerabilities to detect, not implementation of weak crypto

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable