Open Code Review

Scan AI-generated code for hallucinated packages, stale APIs, security anti-patterns, and over-engineering. Use when: (1) reviewing PRs with AI-generated cod...

Security Scan

The skill's stated purpose (scanning AI-generated code) is plausible, but its runtime instructions rely on remote npm/MCP services and mention API keys without declaring required credentials or data-handling guarantees — this creates a risk that repository code or secrets could be sent to external endpoints unexpectedly.

Purpose & Capability

The SKILL.md content matches the advertised purpose (code scanning for AI-specific defects) and references appropriate tooling (an npm CLI, L1–L3 scan levels). However, deeper-scan modes explicitly require an 'Ollama or API key' yet the skill metadata declares no required credentials — an incoherence worth flagging.

Instruction Scope

The instructions instruct use of an npx CLI and an MCP server (either a URL on a third-party worker.dev domain or via 'npx -y @opencodereview/mcp-server'). Running these will cause code and dependency downloads and may send repository code off-host for processing. The SKILL.md does not state data handling, retention, or privacy guarantees, so the agent could unintentionally transmit source code or secrets to external endpoints.

Install Mechanism

There is no formal install spec (instruction-only), but the guide expects dynamic installs via npx and suggests an MCP URL hosted at 'open-code-review-mcp.v2ray-seins.workers.dev' — a non-standard domain (v2ray name) rather than an official release host. Dynamic npx installs and calling an external MCP endpoint are moderate-to-high risk because they fetch and execute remote code at runtime.

Credentials

SKILL.md mentions 'requires Ollama or API key' for deeper scans but the skill metadata lists no required environment variables or primary credential. This mismatch means the skill may need API keys or secrets in practice but doesn't declare them up front, which is incoherent and increases the chance of ad-hoc credential use or accidental leakage.

Persistence & Privilege

The skill does not request always-on inclusion, does not declare config path access, and does not appear to request elevated or persistent platform privileges. Default autonomy is allowed (normal) but not combined with other elevated flags.

What to consider before installing

This skill probably does what it claims (code scanning) but relies on remote services that could receive your repository contents. Before installing or running: (1) confirm where scans are executed (local vs remote) and read the MCP/npx endpoints' privacy/data-retention terms; (2) avoid running deep-scan modes until you know which API key/environment variables are required and how they are used; (3) prefer self-hosting the MCP server or running the CLI in an isolated sandbox if you must scan private code; (4) do not provide repository secrets or wide-scoped tokens to the tool; (5) if the MCP URL or domain looks unfamiliar (the worker.dev host here), treat it as untrusted until you can verify ownership. If you need higher assurance, request the maintainer to declare required env vars, provide a reproducible local install flow, and document data handling.

Open Code Review — AI Code Quality Scanner

Scan codebases for AI-specific defects that traditional linters (ESLint, SonarQube, Checkstyle) cannot detect.

What It Detects

Category	Example	Severity
Hallucinated packages	import { parseJson } from 'fast-json-utils' (package doesn't exist on npm)	🔴 Critical
Stale APIs	response.json().then() with v2 API that was removed in v4	🟡 Warning
Context breaks	Two files reference the same function name with different signatures	🟡 Warning
Security anti-patterns	Hardcoded secrets, deprecated crypto, insecure defaults	🔴 Critical
Over-engineering	Unnecessary abstraction layers, dead code, excessive indirection	🔵 Info

Quick Start

# Install
npx @opencodereview/cli scan ./src --sla L1

# With AI-powered deep scan (requires Ollama or API key)
npx @opencodereview/cli scan ./src --sla L2

# Diff mode for CI/CD
npx @opencodereview/cli scan ./src --diff --base origin/main --head HEAD

# SARIF output for GitHub Actions
npx @opencodereview/cli scan ./src --format sarif --output results.sarif

Three Scan Levels

• L1 — Structural analysis (AST, ~3 seconds, no AI needed)
• L2 — L1 + Embedding recall (detects hallucinated packages via vector similarity)
• L3 — L2 + LLM deep scan (understands context, semantics, business logic)

GitHub Action

- uses: raye-deng/open-code-review@v1
  with:
    scan-path: src/
    sla-level: L1
    diff-mode: true

MCP Server

Available on Smithery, Cursor Directory, and npm:

{
  "mcpServers": {
    "open-code-review": {
      "url": "https://open-code-review-mcp.v2ray-seins.workers.dev/mcp"
    }
  }
}

Or via stdio:

{
  "mcpServers": {
    "open-code-review": {
      "command": "npx",
      "args": ["-y", "@opencodereview/mcp-server"]
    }
  }
}

Supported Languages

TypeScript, JavaScript, Python, Java, Go, Kotlin

When to Use This Skill

• A PR contains AI-generated code (Copilot, Cursor, Claude, GPT)
• You want to catch defects that pass all unit tests but will fail in production
• Pre-merge quality gate for AI-assisted development workflows
• Scanning third-party AI-generated code before integration

When NOT to Use

• Basic linting (use ESLint, Ruff, Checkstyle instead)
• Code formatting (use Prettier, gofmt)
• General code review guidance (use the built-in code-review skill)

Links

• GitHub: https://github.com/raye-deng/open-code-review
• Portal: https://codes.evallab.ai
• npm CLI: @opencodereview/cli
• npm MCP: @opencodereview/mcp-server
• License: BSL 1.1 (free for individuals, commercial subscription for teams)