Skills/ClawHub/ai-code-review-expert

ai-code-review-expert@3.0.4

VERIFIED

Publisher claims: "AI-powered code review assistant — perform deep static analysis, identify security vulnerabilities, enforce coding standards, suggest refactoring patterns, and generate PR review comments. Supports Python, JavaScript, TypeScript, Java, Go, Rust, and more. Integrates with GitHub PR workflows. Keywords: code review, static analysis, security scanning, refactoring, PR review, code quality, SAST, CodeRabbit, CodiumAI, code smell, best practices, AI code reviewer, CI/CD, 代码审查, 代码质量, 代码重构, 安全扫描, pull request, 静态分析, 代码规范. Scope: 对提交的片段/diff 做静态审查与修复建议，输出评审意见与质量评分（advisory only）。 Not for: 自动改写仓库文件、代跑 CI、连接代码托管平台、出具合规认证。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher gechengling · joined 1 days agoInstalls 1,691Last detonated 13 h ago
$clawhub install ai-code-review-expert
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 89/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Access to sensitive file pathsSKILL.md:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

No other findings across 598 lines in 2 files.