Skill

pr-review

skill:saadeghi/daisyui#pr-review

Review one or all open pull requests in saadeghi/daisyui with read-only GitHub data and isolated base-versus-PR checks. Use when Codex must verify a PR, find concrete regressions, decide whether it is safe to merge, and write a concise report under tmp/pr/.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:12 UTC at bf3bac3

findings

medium

highest severity

threat classes

1,032

files scanned

20/20

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/pr-review:.agents/skills/pr-review/SKILL.md:13:HIJACK

Security findings 1

Agent hijacking

mediumContextual riskmedium confidence

The skill hard-delegates the complete PR review task to a custom agent named pr_reviewer whose definition is absent from the repository, so at runtime the entire review would run under agent instructions and tool permissions that no reviewer can inspect.

.agents/skills/pr-review/SKILL.md:13

delegate the complete task to `pr_reviewer` and

vector:instruction

Counter-argument considered

Against the finding: the skill tells the delegate to use this skill and stops if pr_reviewer is unavailable, and the requested definition is absent from the repository. For it: that absence is exactly the problem — the skill makes delegation mandatory ('Do not review the PR in the current agent'), so when a pr_reviewer definition exists at runtime the entire review runs under agent instructions and tool permissions shipped nowhere in the artifact, and the skill's own boundaries cannot constrain a runtime-provided definition. No carve-out or declared claim (read-only GitHub data, tmp-only writes, temp-copy execution) covers handing execution to an uninspectable custom agent, so the finding stands.

Open questions 7

What the analysis could not settle from the code alone.

Does the frontmatter flag metadata.internal: true get consumed by any host or plugin gate (e.g., to skip review or change trust behavior), or is it purely organizational?

SKILL.md lines 7-19 and 30-49 were not shown in this batch; do they contain executable commands, downloads, network sends, or credential access that would connect into a behavior chain with the shown sections?

Code execution

Does the frontmatter flag `metadata.internal: true` cause the host to relax trust or scanning for this skill, given unverifiable status claims carry zero evidentiary weight?

[invalid file request] Is the pr_reviewer custom agent defined at the plugin root's agents directory, and if so, what instructions and tool permissions does it carry?

Agent hijacking

[invalid file request] Is the pr_reviewer custom agent defined in the project .claude/agents directory, and if so, what instructions and tool permissions does it carry?

Agent hijacking

[file request .agents/agents/pr_reviewer.md] The routing section delegates the complete review task to a custom agent named pr_reviewer. Does that agent definition exist in this repository, and if so, what instructions does it carry (does it stay within the declared PR-review task)?

Agent hijacking

[file request .agents/agents/pr_reviewer.md] The skill hard-delegates the complete PR review task to a custom agent named pr_reviewer (SRC:131845ec9d26a049), whose definition is not among the shown units. Where is that agent defined and does its definition honor the skill's read-only boundaries, or does it add capabilities (writes, network sends, credential access) the skill's claims deny?

Agent hijacking

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

The skill instructs the agent to execute untrusted pull-request code on the host inside an OS-temporary credential-free copy, so attacker-controlled PR code runs locally if that isolation is imperfect.

.agents/skills/pr-review/SKILL.md:25

Run PR code only in an OS-temporary copy with no credentials.

Why it was refuted

Executing PR code is the skill's declared core capability ('isolated base-versus-PR checks' used to verify a PR), performed under openly declared mandatory safeguards - inspect before running, credential-free OS-temporary copies, minimal checks at exact SHAs - so the harm gate's declared-core-capability carve-out applies and the residual 'if that isolation is imperfect' risk is speculative. The behavior is also openly declared (a mandatory capability rule), not concealed or contradicting any claim.

Coverage gaps 2

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

packages/docs/static/favicon.ico

request_unanswered request.0: invalid file request (evidence_ids not shown in the asking request)