skill-reviewer — agentic threat model

Not certain from the listing — likely relies on commercial or open-source LLMs for code analysis and generation. Key threats include prompt injection via malicious skill files that trick the model into generating backdoored code or bypassing best-practice checks.

Not certain from the listing — ingests skill files and official best-practice guidelines. Threats include data poisoning of the reference guidelines to lower security standards, or malicious input files designed to cause denial of service or context leakage.

The agent orchestrates a multi-step workflow (fork, edit, PR). Vulnerabilities in the orchestration framework could allow tool misuse, such as manipulating the git tool to target unauthorized repositories or execute arbitrary local commands.

Not certain from the listing — requires execution environment with network access to GitHub. Threats include exposure of GitHub API tokens stored in the environment and lack of container sandboxing during code modification.

Not certain from the listing — no built-in guardrails or observability features are described. This creates a blind spot where malicious or broken code modifications could be pushed to PRs without triggering security alerts.

The agent handles sensitive repository-mutating credentials (e.g., GitHub personal access tokens). Lack of fine-grained scoping (e.g., write access to all repos instead of just the target fork) presents a major authorization and compliance risk.

As a community tool designed to review and modify other agent skills, a compromise of this agent creates a cascading ecosystem threat, potentially introducing vulnerabilities into numerous downstream agent marketplaces.