zxz-test
Analysis
This is a coherent instruction-only code review helper that reads the current Git diff; users should mainly be aware that local uncommitted code may enter the review context.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
执行 `git diff --staged` 获取暂存区的变更。如果为空，回退到 `git diff` 获取未暂存的变更。
This directs the agent to run local Git commands and read staged or unstaged diffs. The commands are read-only and directly support the stated review purpose, but the diff may include private code or accidentally exposed secrets.
Required binaries (all must exist): none; Required binaries (at least one): none
The metadata does not declare Git as a required binary, while SKILL.md instructs use of `git diff`. This is a small dependency-declaration gap, not evidence of hidden installation or unsafe code.