Code Review

AI-powered code analysis via LogicArt — find bugs, security issues, and get logic flow visualizations. Use when reviewing code, analyzing code quality, findi...

Security Scan

The skill does what it says (send code to a remote analyzer) but its runtime instructions and included script will read arbitrary files and POST their contents to a third-party endpoint without warnings or credential checks, creating a real risk of accidental data exfiltration of secrets or private code.

Purpose & Capability

Name/description (code review via LogicArt) match the included script and SKILL.md: the script reads code or files and POSTs them to https://logic.art/api/agent/analyze for analysis. Requiring file reads and network calls is coherent with a remote code-analysis service.

Instruction Scope

SKILL.md and scripts instruct invoking the bundled script or curling the LogicArt API; the analyze.mjs will read any file path passed with --file and send its full contents to an external service. There is no warning about sensitive data or guidance to redact secrets before sending, so normal use could leak credentials or proprietary code.

Install Mechanism

No install spec; the skill is instruction-only with a single Node script. Nothing is downloaded from arbitrary URLs and no archive extraction occurs. Low installation risk.

Credentials

The skill requests no environment variables or credentials (which is consistent), but it performs unauthenticated POSTs of user code to a third-party endpoint. Lack of required credentials means the service may accept unauthenticated uploads — useful but increases risk of sensitive-data transmission without access controls.

Persistence & Privilege

always is false and there are no instructions to modify other skills, system-wide agent config, or persist credentials. The skill does not request elevated/persistent privileges.

What to consider before installing

This skill legitimately sends code to a remote analyzer (LogicArt). Before installing or using it, consider: only submit non-sensitive code (remove keys, passwords, and private data first); verify the destination (https://logic.art) and its privacy policy; test with small, harmless samples first; if you must analyze private repos, prefer a local/static analyzer or a service that supports private/authenticated uploads; monitor network activity if you want to ensure no unexpected data is being sent. If you need higher assurance, ask the publisher how they handle, store, and delete submitted code and whether they support on-prem or authenticated endpoints.

AI code analysis powered by LogicArt at https://logic.art.

Analyze Code

node {baseDir}/scripts/analyze.mjs --code "function add(a,b) { return a - b; }"

Or analyze a file:

node {baseDir}/scripts/analyze.mjs --file path/to/code.js

API

Endpoint: POST https://logic.art/api/agent/analyze

curl -s -X POST "https://logic.art/api/agent/analyze" \
  -H "Content-Type: application/json" \
  -d '{"code": "your code here", "language": "javascript"}'

Response typically includes: bugs, security issues, complexity score, suggestions, and logic flow.

Full Repository Scans

For scanning entire repositories, use Validate Repo: https://validate-repo.replit.app

Presenting Results

When showing results to the user:

1. Lead with critical bugs/security issues
2. Show complexity score
3. List suggestions by priority
4. Include logic flow if provided

Works Great With

• workflow-engine — Chain code reviews into CI/CD pipelines
• quack-coordinator — Hire specialist reviewer agents

Powered by Quack Network 🦆