Skip to content
skillsafebeta
← Report library
Purpose / Development

Requesting Code Review Skill Security Audit

What the author says it does (original text)

Use when completing tasks, implementing major features, or before merging to verify work meets requirements

Independent security check

Security risks found

Files checked
2
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The suggested worktree operation may trigger configured Git hooks

Source references: 1
What we found

The template allows the subagent to execute `git worktree add`. That Git operation can run locally configured hooks when applicable, but the template does not require checking or disabling hooks.

Why this matters

A contaminated local repository configuration or hook could execute commands with the reviewer's permissions and access files or credentials available to that account.

What this evidence establishes

The source does allow `git worktree add`, but it provides no repository hook configuration, global hooksPath setting, or script that would run, so local code execution cannot be established from the supplied evidence. If the environment has a hook applicable to worktree creation/checkout, the operation may trigger it; the impact depends on that external configuration. Users can forbid worktree creation or require inspection of repository and global hook settings first.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
code-reviewer.md:35In the instructionsOpen original file
    Your review is read-only on this checkout. Do not mutate the working tree, the index, HEAD, or branch state in any way. Use tools like `git show`, `git diff`, and `git log` to inspect history. If you need a working copy of a different revision, check it out into a separate temporary directory (e.g. `git worktree add /tmp/review-[SHA] [SHA]`) — never move HEAD on this checkout.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The nominally read-only review may create an uncleaned temporary Git worktree

Source references: 1
What we found

The template permits `git worktree add /tmp/review-[SHA] [SHA]`. This creates another project checkout and registers a worktree, but no cleanup is required, so the overall process is not a state-free read-only operation.

Why this matters

The temporary directory may retain source code and leave worktree records in the repository's Git metadata. Local exposure on a shared machine depends on directory permissions.

Although the template calls the review read-only, it expressly permits `git worktree add`. If used, that operation creates another project checkout under `/tmp` and registers a worktree in repository metadata; the complete supplied source contains no cleanup requirement. This can leave project files, consume disk space, and affect later worktree management. Users can restrict review to `git show/diff/log`, or require an isolated location and guaranteed cleanup.

code-reviewer.md:33In the instructionsOpen original file
    ## Read-Only Review    Your review is read-only on this checkout. Do not mutate the working tree, the index, HEAD, or branch state in any way. Use tools like `git show`, `git diff`, and `git log` to inspect history. If you need a working copy of a different revision, check it out into a separate temporary directory (e.g. `git worktree add /tmp/review-[SHA] [SHA]`) — never move HEAD on this checkout.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Requirements are embedded in the subagent prompt without untrusted-content isolation

Source references: 3
What we found

The template inserts `[PLAN_OR_REQUIREMENTS]` directly into instructions for the subagent without requiring that its contents be treated as untrusted data. Agent-directed text in a requirement or task could be mistaken for review instructions.

Why this matters

Malicious or contaminated requirements could manipulate the review verdict or induce the subagent to disregard the read-only boundary and perform additional actions.

The Skill explicitly inserts plan or requirement content into the reviewer prompt, without labeling it as untrusted data whose embedded instructions must not be followed. If a requirement file or task text contains agent-directed commands, the reviewer may treat them as its own instructions, affecting file access, command execution, or the verdict. Users can ask the author to delimit this content and explicitly prohibit following instructions found inside it.

code-reviewer.md:10In the instructionsOpen original file
  description: "Review code changes"  prompt: |    You are a Senior Code Reviewer with expertise in software architecture,    design patterns, and best practices. Your job is to review completed work    against its plan or requirements and identify issues before they cascade.    ## What Was Implemented    [DESCRIPTION]    ## Requirements / Plan    [PLAN_OR_REQUIREMENTS]
Show 2 other places
code-reviewer.md:137In the instructionsOpen original file
**Placeholders:**- `[DESCRIPTION]` — brief summary of what was built- `[PLAN_OR_REQUIREMENTS]` — what it should do (plan file path, task text, or requirements)- `[BASE_SHA]` — starting commit- `[HEAD_SHA]` — ending commit
SKILL.md:34In the instructionsOpen original file
Dispatch a `general-purpose` subagent, filling the template at [code-reviewer.md](code-reviewer.md)**Placeholders:**- `{DESCRIPTION}` - Brief summary of what you built- `{PLAN_OR_REQUIREMENTS}` - What it should do- `{BASE_SHA}` - Starting commit- `{HEAD_SHA}` - Ending commit
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The Skill requires dispatching a general-purpose subagent after major features and before merging, providing it with the implementation description, requirements, and two Git commit identifiers.

View source
SKILL.md:14In the instructionsOpen original file
**Mandatory:**- After each task in subagent-driven development- After completing major feature- Before merge to main
SKILL.md:32In the instructionsOpen original file
**2. Dispatch code reviewer subagent:**Dispatch a `general-purpose` subagent, filling the template at [code-reviewer.md](code-reviewer.md)**Placeholders:**- `{DESCRIPTION}` - Brief summary of what you built- `{PLAN_OR_REQUIREMENTS}` - What it should do- `{BASE_SHA}` - Starting commit- `{HEAD_SHA}` - Ending commit

The review template directs the subagent to inspect the full diff in the selected commit range, so source code and any sensitive material accidentally committed in that range enter the subagent's review context.

View source
code-reviewer.md:23In the instructionsOpen original file
    ## Git Range to Review    **Base:** [BASE_SHA]    **Head:** [HEAD_SHA]    ```bash    git diff --stat [BASE_SHA]..[HEAD_SHA]    git diff [BASE_SHA]..[HEAD_SHA]    ```

The template explicitly limits the review to read-only inspection, forbids moving the current checkout's HEAD, and prevents the reviewer from spawning further subagents.

View source
code-reviewer.md:33In the instructionsOpen original file
    ## Read-Only Review    Your review is read-only on this checkout. Do not mutate the working tree, the index, HEAD, or branch state in any way. Use tools like `git show`, `git diff`, and `git log` to inspect history. If you need a working copy of a different revision, check it out into a separate temporary directory (e.g. `git worktree add /tmp/review-[SHA] [SHA]`) — never move HEAD on this checkout.    ## You Do Not Dispatch Subagents    Do all of this review yourself. Never spawn a subagent to review part    of the diff, and never spawn another reviewer for a second opinion.
Start here · InstructionsSKILL.md
requesting-code-review
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • code-reviewer.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • code-reviewer.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:27In the instructionsOpen original file
**1. Get git SHAs:**```bashBASE_SHA=$(git rev-parse HEAD~1)  # or origin/main
code-reviewer.md:28In the instructionsOpen original file
    ```bash    git diff --stat [BASE_SHA]..[HEAD_SHA]
Lines read
278
File checksum (to compare versions)
cc817b7b6ab0413a616c7558540c112eecc0ada3d1e3b83f392c0b8d2ac7d97d