Why this verdict
- suspicious: finding skill:skills/code-review:skills/code-review/SKILL.md:142:SUPPLY
Security findings 1
Supply chain
mediumContextual risklow confidenceThe skill instructs the agent to install the unpinned third-party package radon from PyPI and immediately execute it, so whatever code the registry currently serves is downloaded and run on the host under a mutable version target.
pip install radon && radon cc . -a
vector:instruction
Counter-argument considered
The command appears verbatim in the skill's Review Commands section and installs radon from PyPI with no version pin before immediately executing it; the official-registry carve-out accepts only pinned installs, and no declared claim (the sole claim D2 covers running the reviewed code) declares third-party package installation, so no cited evidence kills the finding.
Open questions 1
What the analysis could not settle from the code alone.
Detector leads DET:c7bf6c28abe23f94/DET:e8c45e21edcacf8b (os.system(f'ls {user_input}') / subprocess.run(['ls', user_input])) and DET:597a8a6ff4453e36 (eval(userCode)) cite lines that are explicitly labeled '# Bad:' educational examples of insecure code inside fenced blocks of a code-review skill, matching the security-education carve-out; no execution path, concealment, or destination is present, so they were verified and not converted into findings.
Code execution
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
web/src/app/favicon.ico
