Skill

issue-review

skill:voyager-crew/voyager#issue-review

Investigate or fix a referenced Voyager GitHub issue, within the requested delivery scope.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:18 UTC at 9e15cc2

findings

high

highest severity

threat classes

4,840

files scanned

13/13

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/issue-review:.agents/skills/issue-review/SKILL.md:10:SUPPLY
suspicious: finding skill:.agents/skills/issue-review:.agents/skills/issue-review/SKILL.md:9:EXEC

Security findings 2

Code execution

highContextual riskmedium confidence

The issue-review skill directs the agent to apply verification instructions from AGENTS.md, a repository file outside the consumed agent surface, so unreviewed commands will be executed at runtime when the skill delivers a fix.

.agents/skills/issue-review/SKILL.md:9

implementation delivers the scoped change and applicable verification from `AGENTS.md`

vector:instruction

Counter-argument considered

The qualifier 'applicable' narrows but does not neutralize the vector: the instruction makes the agent read AGENTS.md at runtime and execute whatever verification commands that unreviewed repository file contains, which is not a carve-out, is not covered by the declared description or the single declared claim, and forms a concrete source-to-sink chain. The finding stands.

Supply chain

mediumContextual riskmedium confidence

The issue-review skill delegates committing and publishing to the voyager-contribute skill, which lies outside the consumed agent surface, so the publishing instructions the agent will follow are not covered by this artifact's reviewed declaration.

.agents/skills/issue-review/SKILL.md:10

When the request includes committing or publishing, use `voyager-contribute`

vector:instruction

Counter-argument considered

The strongest case against it (delegation is transparent and publishing may fall in the requested delivery scope) fails: the quote is exact, and the behavior — the agent consuming and following voyager-contribute content that this artifact does not ship or review — matches no carve-out and is absent from the declared description and claims, with no mitigation neutralizing the exposure. The finding survives all four gates.

Open questions 4

What the analysis could not settle from the code alone.

[file request .agents/skills/voyager-contribute/SKILL.md] The body instructs the agent to use `voyager-contribute` when the request includes committing or publishing; does that referenced skill contain instructions or behavior beyond scoped commit/PR publishing (hidden directives, secrecy, writes outside the repo)?

Code execution

[file request AGENTS.md] The body directs the agent to apply 'applicable verification from AGENTS.md' to delivered changes; do those verification instructions include commands or operations beyond scoped verification of the fix?

Code execution

[file request .agents/skills/voyager-contribute/SKILL.md] Issue-review step 3 delegates committing and publishing to the voyager-contribute skill ('use `voyager-contribute`'); does that skill stay within publishing the reviewed fix, or does it introduce capabilities the issue-review declaration does not cover?

Supply chain

[file request AGENTS.md] Issue-review step 2 applies 'applicable verification from `AGENTS.md`' to the scoped change; what commands and instructions does AGENTS.md actually contain that the agent will execute during this skill?

Code execution

Execution chain 1

What it calls, runs, installs, reads and writes, with the line that does it.

Files written 1

--comments

.agents/skills/issue-review/SKILL.md:8 · instructed