Code Review ProMax

AdvisoryAudited by Static analysis on May 13, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If you provide a commit hash, PR, or MR link, the agent may read repository data through local tools or provider APIs instead of only reviewing pasted text.

Why it was flagged

The skill tells the agent to use local git/gh commands and GitHub/GitLab APIs to retrieve diffs and review context. These actions are central to the code-review purpose and appear read-only, but they mean linked reviews may involve command/tool use and external network requests.

Skill content

提供 Git commit hash ... `git show <hash>` 或 `git diff <hash>~1 <hash>` 获取 diff ... `gh pr diff <pr_number> -R <owner>/<repo>` 获取 diff ... 使用 GitHub API ... 使用 GitLab API

Recommendation

Use this skill only with repositories and links you intend the agent to access; paste a diff manually if you want to avoid external fetching.