voltagent-code-reviewer

Several skills in this collection read and process user-provided files without establishing clear data boundaries. Skills like accessibility-tester, architect-reviewer, chaos-engineer, and code-reviewer all use tools like Read, Grep, and Glob to process user content, then incorporate that content into their analysis and responses. The instructions lack explicit markers that would prevent instruction-like content in user files from being interpreted as directives to the agent.

Multiple skills (accessibility-tester, ad-security-reviewer, architect-reviewer, chaos-engineer, code-reviewer) declare the Bash tool as a dependency and include instructions that could lead to executing shell commands with user-provided content. While the skills don't explicitly show shell command construction with user input, the combination of Bash tool access and processing user files creates a potential injection surface if user content contains shell metacharacters or command sequences.

The skill declares itself as 'voltagent-code-reviewer' but contains multiple complete agent definitions including accessibility-tester, ad-security-reviewer, architect-reviewer, chaos-engineer, and code-reviewer. This represents a significant volume mismatch where the actual content far exceeds what would be expected from the declared identity.

Several skills contain 'always' directives that could persist beyond the current task execution. These include broad behavioral rules like 'Always prioritize user needs' and 'Always prioritize safety' that lack explicit scope boundaries to the skill's declared purpose.

The code-reviewer skill declares expertise across 'multiple programming languages' and claims authority over security vulnerability detection, which extends beyond typical code review scope into security auditing territory. While not explicitly malicious, this broad scope claim could enable privilege escalation if combined with other attack vectors.

The skill contains numerous package installation commands (pip install, npm install, apt-get install, etc.) throughout various agent files that are not declared in the skill's dependencies. This creates a significant attack surface where malicious packages could be installed without user awareness or review.