p3c-code-quality

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may inspect project source code and add a report file to the workspace.

Why it was flagged

The skill instructs the agent to read local Java source files and write a report. This is expected for code-quality checking, but users should be aware that local code contents are accessed and a file is created.

Skill content
使用 `Glob` 查找所有 `.java` 文件...使用 `Read` 读取文件内容...使用 `Write` 工具生成 Markdown 格式报告
Recommendation

Invoke it only on the intended project path and review the generated report path before accepting changes.

What this means

Actual behavior may depend on the installed versions of the referenced P3C subskills.

Why it was flagged

The skill discloses that it depends on several referenced subskills. This is coherent for an aggregate checker, but those subskills are not part of the provided artifact set.

Skill content
本技能是聚合技能,会调用以下子技能...p3c-coding-style...p3c-exception-logging...p3c-security-rules...p3c-unit-testing
Recommendation

Before relying on the aggregate skill, verify that the referenced subskills are installed from trusted sources and match the expected P3C review purpose.