Security audit
Security checks for vulnerabilities and agentic risk
This code-review skill is purpose-aligned but can send user code or files to an external LogicArt API without a runtime consent check or tight activation scope.
Review this carefully before installing. Use it only for code you are comfortable sending to LogicArt, and avoid running it on proprietary repositories, secrets, credentials, regulated data, or files that have not been reviewed for sensitive content.
The skill describes code analysis workflows and external endpoints but does not clearly warn that user code or repository contents may be sent to third-party services. In a code-review context, this is especially risky because source code often contains proprietary logic, credentials, secrets, or regulated data, and users may reasonably assume analysis is local unless told otherwise.
The skill demonstrates network-capable behavior by sending code to an external API, but it does not declare any explicit tool scope or permissions. This creates a governance gap: users and policy systems cannot clearly see that network access is required, increasing the risk of silent data exfiltration or misuse.
The trigger phrases are very broad and match common developer requests like reviewing code or finding bugs, which can cause the skill to activate in many ordinary contexts. Because the skill routes content to third-party services, overbroad activation increases the chance that sensitive code is transmitted when the user did not intend to use an external analyzer.
The skill includes a concrete example of transmitting source code to an external service via HTTPS POST. External transmission is not inherently malicious, but in this context it is security-relevant because it can export sensitive source code and associated intellectual property to a third party, especially when combined with broad triggers and missing disclosure.
Endpoint: POST https://logic.art/api/agent/analyze
curl -s -X POST "https://logic.art/api/agent/analyze" \
-H "Content-Type: application/json" \
-d '{"code": "your code here", "language": "javascript"}'
The script transmits user-supplied code and inferred language to a third-party service at logic.art without any explicit consent prompt, warning, or visible disclosure at runtime. In a code-review skill, this is especially risky because users may analyze proprietary source code, secrets, credentials, or internal business logic and unknowingly exfiltrate sensitive material outside their trust boundary.
No suspicious patterns detected.