Code Reviewer

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only code-review skill is coherent and non-mutating, with a noteworthy optional mode that may share code with another model and log a review trail.

This skill appears safe for normal code-review use and does not modify files. Before using --dual or enabling review-trail logging, make sure the code can be shared with the configured second model and that any stored review records are acceptable for your confidentiality needs.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If --dual is used, proprietary or sensitive code may be sent to another configured model environment according to the agent platform’s routing and retention settings.

Why it was flagged

The optional --dual workflow shares the reviewed code artifact or diff with a second model/sub-agent. This is purpose-aligned for cross-model review, but users should notice the additional model/provider data flow.

Skill content
Primary reviewer (main agent) → spawns second-model sub-agent with target file/diff
Recommendation

Use --dual only when the code is appropriate to share with the configured second model, and prefer the default single-model review for highly sensitive code unless provider and retention settings are acceptable.

What this means

Sensitive code details or security findings could be retained in logs if the surrounding workflow enables review-trail logging.

Why it was flagged

The skill may create a review trail containing findings, decisions, and possibly code context. This is conditional and purpose-aligned, but it may persist sensitive review information outside the immediate response.

Skill content
Log the review trail when the surrounding workflow calls for evidence.
Recommendation

Confirm where review trails are stored, who can access them, and whether sensitive snippets should be redacted before enabling logging.