Security audit
review-github-pr
Security checks across malware telemetry and agentic risk
Overview
This skill is a clearly scoped GitHub PR review assistant that reads PR data, runs disclosed local checks, and only posts a review after user confirmation.
Before installing, understand that this skill will check out PR code, read changed files, run the repository's configured validation command, and may post review comments using your GitHub credentials only after you confirm. Use it on repositories where running local project checks is acceptable.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.