adversarial-review

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The workflow explicitly requires sending repository diffs and internal principle files to an opposite-model CLI (codex/claude), includes flags that bypass checks (--skip-git-repo-check) and suppress output (2>/dev/null), and forbids internal delegation — collectively creating a high risk of deliberate data exfiltration and audit-evasion to external services.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). The skill’s runtime workflow explicitly reads multiple outsider-authored free-text sources into the LLM context: it loads brain/principles.md plus each linked [[wikilink]] principle file (content authored outside the operating user’s own prompts/files), and it also ingests the reviewers’ outputs ($REVIEW_DIR/*.md) generated by the opposite model’s CLI, which are free-form text not authored by the operating user.