Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Code Review
v1.0.0AI-powered code analysis via LogicArt — find bugs, security issues, and get logic flow visualizations. Use when reviewing code, analyzing code quality, findi...
⭐ 0· 2k·20 current·20 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (code review via LogicArt) match the included script and SKILL.md: the script reads code or files and POSTs them to https://logic.art/api/agent/analyze for analysis. Requiring file reads and network calls is coherent with a remote code-analysis service.
Instruction Scope
SKILL.md and scripts instruct invoking the bundled script or curling the LogicArt API; the analyze.mjs will read any file path passed with --file and send its full contents to an external service. There is no warning about sensitive data or guidance to redact secrets before sending, so normal use could leak credentials or proprietary code.
Install Mechanism
No install spec; the skill is instruction-only with a single Node script. Nothing is downloaded from arbitrary URLs and no archive extraction occurs. Low installation risk.
Credentials
The skill requests no environment variables or credentials (which is consistent), but it performs unauthenticated POSTs of user code to a third-party endpoint. Lack of required credentials means the service may accept unauthenticated uploads — useful but increases risk of sensitive-data transmission without access controls.
Persistence & Privilege
always is false and there are no instructions to modify other skills, system-wide agent config, or persist credentials. The skill does not request elevated/persistent privileges.
What to consider before installing
This skill legitimately sends code to a remote analyzer (LogicArt). Before installing or using it, consider: only submit non-sensitive code (remove keys, passwords, and private data first); verify the destination (https://logic.art) and its privacy policy; test with small, harmless samples first; if you must analyze private repos, prefer a local/static analyzer or a service that supports private/authenticated uploads; monitor network activity if you want to ensure no unexpected data is being sent. If you need higher assurance, ask the publisher how they handle, store, and delete submitted code and whether they support on-prem or authenticated endpoints.Like a lobster shell, security has layers — review code before you run it.
latestvk97d813f8pq67z4eanxvhk2hhs81vbtc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.