📦 Open Code Review — 技能工具
v1.0.0Scan AI-generated code for hallucinated packages, stale APIs, security anti-patterns, and over-engineering. Use when: (1) reviewing PRs with AI-generated cod...
0· 276·0 当前·0 累计
by @raye-deng 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (scanning AI-generated code) is plausible, but its runtime instructions rely on remote npm/MCP services and mention API keys without declaring required credentials or data-handling guarantees — this creates a risk that repository code or secrets could be sent to external endpoints unexpectedly.
评估建议
This skill probably does what it claims (code scanning) but relies on remote services that could receive your repository contents. Before installing or running: (1) confirm where scans are executed (local vs remote) and read the MCP/npx endpoints' privacy/data-retention terms; (2) avoid running deep-scan modes until you know which API key/environment variables are required and how they are used; (3) prefer self-hosting the MCP server or running the CLI in an isolated sandbox if you must scan pri...详细分析 ▾
ℹ 用途与能力
The SKILL.md content matches the advertised purpose (code scanning for AI-specific defects) and references appropriate tooling (an npm CLI, L1–L3 scan levels). However, deeper-scan modes explicitly require an 'Ollama or API key' yet the skill metadata declares no required credentials — an incoherence worth flagging.
⚠ 指令范围
The instructions instruct use of an npx CLI and an MCP server (either a URL on a third-party worker.dev domain or via 'npx -y @opencodereview/mcp-server'). Running these will cause code and dependency downloads and may send repository code off-host for processing. The SKILL.md does not state data handling, retention, or privacy guarantees, so the agent could unintentionally transmit source code or secrets to external endpoints.
⚠ 安装机制
There is no formal install spec (instruction-only), but the guide expects dynamic installs via npx and suggests an MCP URL hosted at 'open-code-review-mcp.v2ray-seins.workers.dev' — a non-standard domain (v2ray name) rather than an official release host. Dynamic npx installs and calling an external MCP endpoint are moderate-to-high risk because they fetch and execute remote code at runtime.
⚠ 凭证需求
SKILL.md mentions 'requires Ollama or API key' for deeper scans but the skill metadata lists no required environment variables or primary credential. This mismatch means the skill may need API keys or secrets in practice but doesn't declare them up front, which is incoherent and increases the chance of ad-hoc credential use or accidental leakage.
✓ 持久化与权限
The skill does not request always-on inclusion, does not declare config path access, and does not appear to request elevated or persistent platform privileges. Default autonomy is allowed (normal) but not combined with other elevated flags.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install open-code-review
镜像加速npx clawhub@latest install open-code-review --registry https://cn.longxiaskill.com镜像同步中