Why this verdict
- suspicious: finding skill:.claude/skills/review-prs:.claude/skills/review-prs/SKILL.md:23:SUPPLY
- suspicious: finding skill:.claude/skills/review-prs:.claude/skills/review-prs/SKILL.md:27:EXEC
Security findings 2
Code execution
highContextual risklow confidenceThe review-prs skill instructs the agent to run `make test` before committing and pushing a merged PR, executing a Makefile that exists in the repository but is not part of the content any agent consumes, so the executed commands cannot be reviewed.
`make test`, commit
vector:instruction
Counter-argument considered
The consumed skill body instructs the agent to run `make test` as a required pre-commit step, and the follow-up confirms the Makefile exists in the repository outside all consumed content, so arbitrary unreviewable commands would execute with the agent's repo access and push rights; absence of the Makefile's text is not evidence of safety and no accepted carve-out (including build-dir cleanup or declared core capability) covers executing a non-shipped Makefile.
Supply chain
mediumContextual risklow confidenceThe review-prs skill delegates the admission judgment to the `audit-the-list` skill, whose instruction file exists in the repository but is outside all agent-consumed content, so the agent applies unreviewable instructions while deciding which PRs merge or close.
invoke the `audit-the-list` skill with arguments in this shape
vector:instruction
Counter-argument considered
The consumed skill body explicitly routes merge/close verdicts through the audit-the-list skill, and the follow-up confirms that file exists in the repository outside every consumed skill surface, so admission decisions would be steered by instructions no review can see; the file being unreviewable is the claimed harm, its absence from the consumed set is never evidence of safety, and no carve-out or artifact mitigation neutralizes the indirection.
Open questions 2
What the analysis could not settle from the code alone.
The Act step defines an explicit AskUserQuestion confirmation loop for closing PRs but states no explicit confirmation mechanism for merges ('a clean PR merges with gh pr merge'); does the maintainer adjudicate each merge verdict before the merge executes, or can the agent merge PRs on the delegated skill's verdict alone?
The SKILL.md frontmatter unit is delivered as kind=decoded (text recovered from an encoded or hidden channel). The recovered text is a benign name/description/argument-hint block, but confirm whether the shipped file stores this frontmatter encoded and why, since a concealment channel on the skill entry file matters even when the decoded content itself is benign.
