Skills/ClawHub/ai-code-review-expert

ai-code-review-expert@3.0.5

VERIFIED· install only

Publisher claims: "AI-powered code review assistant — perform deep static analysis, identify security vulnerabilities, enforce coding standards, suggest refactoring patterns, and generate PR review comments. Supports Python, JavaScript, TypeScript, Java, Go, Rust, and more. Integrates with GitHub PR workflows. Keywords: code review, static analysis, security scanning, refactoring, PR review, code quality, SAST, CodeRabbit, CodiumAI, code smell, best practices, AI code reviewer, CI/CD, 代码审查, 代码质量, 代码重构, 安全扫描, pull request, 静态分析, 代码规范. Scope: 对提交的片段/diff 做静态审查与修复建议，输出评审意见与质量评分（advisory only）。 Not for: 自动改写仓库文件、代跑 CI、连接代码托管平台、出具合规认证。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher gechengling · publishing for 180 daysInstalls 1,801Last detonated 29 min ago
$clawhub install ai-code-review-expert
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 90/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsSKILL.md:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **只提交需要评审的片段**：优先提交单个函数、单个 diff 或单个文件；不要把整个仓库、`.env`、密钥文件、生产数据样本整包贴入。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

No other findings across 586 lines in 1 files.

Cost to the agent

Instructions loaded
≈5,508 tok
1 file · 1 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.