Code Review Assistant

This skill claims to perform automated, multi-language code reviews and vulnerability scans, but the included code is just a small Bash script that prints example reports rather than analyzing your code. If you expect real analysis, do not rely on this skill yet. Before installing or granting any secrets (e.g., GITHUB_TOKEN): 1) inspect the script and any other code to confirm it actually performs analysis (search for calls to linters, static analyzers, or network APIs); 2) run it in a sandbox or test repo to observe behavior; 3) do not provide tokens or integrate into CI until the PR logic and credential handling have been reviewed; 4) if you need genuine code scanning, prefer well-known tools (semgrep, eslint, bandit, gosec, etc.) or a skill that clearly documents and executes those engines. The mismatch between claims and implementation is a red flag—treat this as a stub or demo, not a production analyzer.