errorlens

Error handling & exception safety analyzer -- scans codebases for empty catches, swallowed exceptions, missing error boundaries, unhandled rejections, generi...

Security Scan

The skill is internally consistent with its stated purpose (a local, regex-based error-handling scanner that can install git pre-commit hooks and optionally uses an offline license key); nothing in the package requests unrelated credentials or reaches out to external endpoints.

Purpose & Capability

Name, description, and included scripts implement a local regex-based error-handling scanner, pre-commit hook integration (lefthook), reporting, watch/CI/team modes gated behind a license key. Required binaries (git, bash, python3, jq) and the brew lefthook install are proportionate to the described functionality.

Instruction Scope

Runtime instructions source and execute the shipped bash scripts (patterns.sh, analyzer.sh, license.sh). The pre-commit hook installs run those local scripts from $HOME/.openclaw/skills/errorlens or project lefthook.yml; thus commits will execute code from the skill directory. The analyzer reads ~/.openclaw/openclaw.json (to find a configured license key) and optional .errorlens-allowlist/.errorlens-baseline files in the repo. There are no network calls or external endpoints in the scripts; however, installing the hook grants the skill's code the ability to run on every git commit, so you must trust the shipped scripts before enabling hooks.

Install Mechanism

Install spec uses a single brew formula (lefthook), which is a known git-hook manager. No downloads from untrusted URLs or archive extraction are present. The skill's own files are supplied in the bundle (scripts, patterns, config).

Credentials

The only credential surface is ERRORLENS_LICENSE_KEY (primaryEnv) used to enable Pro/Team features; that is consistent with the pro/team features described. The license module reads the key from the environment or from ~/.openclaw/openclaw.json; it does not attempt to read unrelated secrets. An optional CLAWHUB_JWT_SECRET is only used to verify JWT signatures if present — not required for normal operation.

Persistence & Privilege

always:false and user-invocable:true (normal). Installing hooks writes/edits lefthook.yml in the repository and calls lefthook install; the skill does not request permanent platform-wide privileges beyond adding hooks to repos the user chooses. Because hooks execute the skill's scripts on commit, installing hooks grants those scripts execution on future commits — review the code before enabling hooks.

Assessment

This skill appears to do what it claims: a local, regex-based error-handling scanner with optional pre-commit hooks and license-gated features. Before installing or enabling hooks you should: (1) inspect the shipped scripts (patterns.sh, analyzer.sh, license.sh) — hooks will execute those scripts on every commit; (2) keep your license key in the environment or ~/.openclaw/openclaw.json as described and only provide a key intended for ErrorLens; (3) ensure you trust the lefthook tool (brew install lefthook) and verify any appended lefthook.yml changes in your repo. Nothing in the code attempts network exfiltration, but installing the pre-commit hook gives the skill's code execution on commits, so enable hooks only for repositories you trust.

ErrorLens -- Error Handling & Exception Safety Analyzer

ErrorLens scans codebases for dangerous error handling patterns: empty catch blocks, swallowed exceptions, missing error boundaries, unhandled promise rejections, generic error types, missing finally blocks, bare except clauses, error message information leaks, unchecked error returns, and missing error propagation. Covers JS/TS, Python, Java, Go, Rust, and C#. Uses regex-based pattern matching against 90+ error handling anti-patterns, lefthook for git hook integration, and produces markdown reports with actionable remediation recommendations. 100% local. Zero telemetry.

Commands

Free Tier (No license required)

errorlens scan [file|directory]

One-shot error handling scan of files or directories.

How to execute:

bash "<SKILL_DIR>/scripts/errorlens.sh" scan [target]

What it does:

1. Accepts a file path or directory (defaults to current directory)
2. Discovers all source files (skips .git, node_modules, binaries, images, .min.js)
3. Runs 90+ error handling pattern checks against each file
4. Respects .gitignore and allowlist files
5. Calculates an error safety score (0-100) per file and overall
6. Grades: A (90-100), B (80-89), C (70-79), D (60-69), F (<60)
7. Outputs findings with: file, line number, check ID, severity, description, recommendation
8. Exit code 0 if score >= 70, exit code 1 if too many issues found
9. Free tier limited to 5 files per scan

Example usage scenarios:

• "Scan my code for error handling issues" -> runs errorlens scan .
• "Check this file for empty catch blocks" -> runs errorlens scan src/api.ts
• "Find swallowed exceptions in my project" -> runs errorlens scan src/
• "Are there unsafe error patterns in my code?" -> runs errorlens scan .
• "Check for missing error boundaries" -> runs errorlens scan .

errorlens hook

Install git pre-commit hooks that scan staged files for error handling issues before every commit.

How to execute:

bash "<SKILL_DIR>/scripts/errorlens.sh" hook install

What it does:

1. Copies lefthook config to project root
2. Installs lefthook pre-commit hook
3. On every commit: scans all staged files for error handling issues, blocks commit if critical/high findings, shows remediation advice

errorlens report [directory]

Generate a markdown error handling report with findings, severity breakdown, and remediation steps.

How to execute:

bash "<SKILL_DIR>/scripts/errorlens.sh" report [directory]

What it does:

1. Runs full scan of the directory
2. Generates a formatted markdown report from template
3. Includes per-file breakdowns, error safety scores, remediation priority
4. Output suitable for code reviews and quality audits

Pro Tier ($19/user/month -- requires ERRORLENS_LICENSE_KEY)

errorlens watch [directory]

Continuous monitoring mode that watches for file changes and re-scans automatically.

How to execute:

bash "<SKILL_DIR>/scripts/errorlens.sh" watch [directory]

What it does:

1. Validates Pro+ license
2. Watches directory for file modifications
3. Re-scans changed files automatically on save
4. Displays live error handling score updates
5. Useful for development-time feedback

errorlens ci [directory]

CI/CD integration mode with strict exit codes and machine-readable output.

How to execute:

bash "<SKILL_DIR>/scripts/errorlens.sh" ci [directory]

What it does:

1. Validates Pro+ license
2. Runs full scan with no file limit
3. Outputs findings in CI-friendly format
4. Exit code 0 = pass (score >= 70), 1 = fail
5. Supports severity threshold configuration
6. Suitable for GitHub Actions, GitLab CI, Jenkins, etc.

Team Tier ($39/user/month -- requires ERRORLENS_LICENSE_KEY with team tier)

errorlens team-report [directory]

Aggregate team-level error handling metrics and trends.

How to execute:

bash "<SKILL_DIR>/scripts/errorlens.sh" team-report [directory]

What it does:

1. Validates Team+ license
2. Scans entire directory with full pattern set
3. Generates aggregate metrics per category (EC, SE, EB, GE, RP, IL)
4. Shows per-directory breakdown for team ownership analysis
5. Includes trend data if previous baselines exist
6. Reports team-wide error handling maturity score

errorlens baseline [directory]

Establish a baseline of known error handling issues for incremental improvement tracking.

How to execute:

bash "<SKILL_DIR>/scripts/errorlens.sh" baseline [directory]

What it does:

1. Validates Team+ license
2. Scans directory and records all current findings as baseline
3. Saves baseline to .errorlens-baseline.json
4. Future scans only report NEW issues not in the baseline
5. Useful for legacy codebases with known accepted patterns
6. Enables incremental error handling improvement tracking

errorlens status

Show license and configuration information.

bash "<SKILL_DIR>/scripts/errorlens.sh" status

Detected Error Handling Patterns

ErrorLens detects 90+ error handling anti-patterns across 6 categories:

Category	Examples	Severity
Empty Catches (EC)	Empty catch blocks in JS/TS/Java/C#/Python, catch with only comments, catch with only pass, catch-all without logging	Critical/High
Swallowed Exceptions (SE)	Catch blocks that don't rethrow/log, exception variable unused, catch that returns null/undefined/false silently, ignored error callbacks	Critical/High
Error Boundaries (EB)	Missing React error boundaries, missing Express error middleware, missing global handlers, unhandled promise rejections, window.onerror	High/Medium
Generic Errors (GE)	Throwing generic Error/Exception, bare except in Python, catching Throwable in Java, catching Object in TS, overly broad error types	High/Medium
Resource & Propagation (RP)	Missing finally for resource cleanup, unchecked error returns in Go, missing error propagation (? in Rust), ignored Result types, missing defer/close	High/Medium
Information Leak (IL)	Stack traces in HTTP responses, error.message in API responses, console.error with sensitive data, verbose errors in production, raw exception details to users	High/Medium

Configuration

Users can configure ErrorLens in ~/.openclaw/openclaw.json:

{
  "skills": {
    "entries": {
      "errorlens": {
        "enabled": true,
        "apiKey": "YOUR_LICENSE_KEY_HERE",
        "config": {
          "severityThreshold": "high",
          "ignorePatterns": ["**/test/**", "**/fixtures/**", "**/*.test.*"],
          "ignoreChecks": [],
          "allowlistFile": ".errorlens-allowlist",
          "reportFormat": "markdown"
        }
      }
    }
  }
}

Important Notes

• Free tier works immediately with no configuration
• All scanning happens locally -- no code is sent to external servers
• License validation is offline -- no phone-home or network calls
• Pattern matching only -- no AST parsing, no external dependencies beyond bash
• Supports scanning all file types in a single pass
• Git hooks use lefthook which must be installed (see install metadata above)
• Exit codes: 0 = clean (score >= 70), 1 = issues detected (for CI/CD integration)

Error Handling

• If lefthook is not installed and user tries hook install, prompt to install it
• If license key is invalid or expired, show clear message with link to https://errorlens.pages.dev/renew
• If a file is binary, skip it automatically with no warning
• If no scannable files found in target, report clean scan with info message
• If .errorlens-allowlist is missing, skip allowlist filtering gracefully

When to Use ErrorLens

The user might say things like:

• "Scan my code for error handling issues"
• "Find empty catch blocks in my project"
• "Check for swallowed exceptions"
• "Are there missing error boundaries?"
• "Scan for unsafe error patterns"
• "Find unhandled promise rejections"
• "Check if my error handling is correct"
• "Detect bare except clauses"
• "Run an error handling audit"
• "Set up pre-commit hooks for error handling"
• "Generate an error handling report"
• "Find catch blocks that don't rethrow"
• "Check for generic error types"
• "Scan for information leaks in error messages"
• "Audit my code for exception safety"
• "Find missing finally blocks"
• "Check for unchecked error returns in Go"
• "Baseline existing error handling issues"