Why this verdict
- suspicious: finding skill:.agents/skills/code-review-graph:.agents/skills/code-review-graph/SKILL.md:250:EXEC
- suspicious: finding skill:.agents/skills/code-review-graph:.agents/skills/code-review-graph/SKILL.md:33:SUPPLY
- suspicious: finding skill:.agents/skills/code-review-graph:.agents/skills/code-review-graph/SKILL.md:34:SUPPLY
- suspicious: finding skill:.agents/skills/code-review-graph:.agents/skills/code-review-graph/SKILL.md:97:SUPPLY
Security findings 4
Code execution
highContextual risklow confidenceSKILL.md directs the user/agent to check tsconfig_resolver.py, a script not shipped anywhere in the artifact, so following this reference means reading or relying on whatever content resolves at that path at runtime, which nobody can review.
Check `tsconfig_resolver.py` handles your setup
vector:instruction
Counter-argument considered
Survives: the skill body's mitigation column instructs the agent to check tsconfig_resolver.py, the requested follow-up confirms the artifact ships no such file (NOT IN REPOSITORY), so following the directive makes the agent read or run whatever resolves at that path at runtime — an undeclared supply-chain vector not covered by any carve-out or by declared claims D15-D18, which cover only the limitation rows for dynamic imports, reflection, runtime-generated code, cross-language boundaries, and stale graphs.
Supply chain
mediumContextual risklow confidenceThe skill's Bootstrap Protocol instructs the agent, whenever invoked during /plan or standard usage on a mid-to-large project, to propose installing the unpinned PyPI package code-review-graph, which would bring unpinned remote code into the environment, though the instruction explicitly requires user confirmation before installing or building.
Would you like to `pip install code-review-graph` and build a local map to cut token usage for this project?
trigger:conditionalvector:instruction
Counter-argument considered
The unpinned PyPI proposal matches no carve-out (the registry-install carve-out requires a version pin) and the confirmation clause is already part of the finding's own claim, so no cited evidence shows the finding wrong; the failed undeclared gate only reflects that the proposal is a declared, confirmation-gated behavior the finding openly discloses.
Supply chain
mediumContextual riskmedium confidenceThe skill instructs the agent to install the unpinned PyPI package code-review-graph (pipx/uvx/pip, no version pin) via its Bootstrap Protocol and then run its installer, executing remote code and MCP-config writes the artifact itself does not ship — an undeclared supply risk that is nonetheless openly documented and gated behind explicit user confirmation.
Would you like to `pip install code-review-graph` and build a local map to cut token usage for this project?
vector:instruction
Counter-argument considered
Unpinned registry install followed by executing the package's installer matches no carve-out — the pinned-registry carve-out requires a pin and this has none — and open documentation does not neutralize harm; the finding already concedes the documentation and confirmation gate, so its core claim is not shown wrong.
Supply chain
mediumContextual risklow confidenceThe skill instructs the agent to run a setup step that installs the unpinned PyPI package code-review-graph via pipx/uvx/pip before the review task, fetching and executing remote code whose version and content are not fixed.
pip install code-review-graph
vector:instruction
Counter-argument considered
The unpinned `pip install code-review-graph` instruction matches no carve-out (no version pin, so the pinned-registry carve-out is inapplicable); it is openly documented as the skill's own setup step, which fails only the undeclared gate and lowers severity but does not show the supply finding wrong.
Open questions 3
What the analysis could not settle from the code alone.
SKILL.md declares the graph stores structural metadata only with no source code content; the MCP server implementation that would confirm or refute this claim is not part of the units shown, so the declared privacy property cannot be verified in this pass.
The SKILL.md frontmatter unit is delivered as a decoded/hidden channel (kind=decoded), yet the shown text contains no visible encoding, unicode, or padding markers; whether the skill metadata was originally concealed cannot be settled from the evidence shown.
[file request tsconfig_resolver.py] The Known Limitations section references tsconfig_resolver.py as code the user should check; does this file exist in the artifact and does it contain any behavior beyond TypeScript path-alias resolution (network access, config writes, or execution of other code)?
Code execution
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Persistence
criticalRefutedlow confidenceThe skill directs the agent to run the unpinned package's installer, which auto-detects and writes MCP server registrations into agent client configurations (claude-code, cursor, windsurf) that persist and activate on editor restart, giving the external package a standing foothold in the agent's tool surface.
code-review-graph install --platform claude-code
Why it was refuted
The flagged command is the vendor tool's own installer presented in fenced setup documentation, and the persistence it creates is the openly declared activation mechanism of the skill's declared core capability (using code-review-graph as an MCP server), so the harm carve-out for vendor installers in fenced install docs applies and the behavior is declared, not concealed.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
web/public/favicon.ico
