← Back to Skills Marketplace
295
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install open-code-review
Description
Scan AI-generated code for hallucinated packages, stale APIs, security anti-patterns, and over-engineering. Use when: (1) reviewing PRs with AI-generated cod...
Usage Guidance
This skill probably does what it claims (code scanning) but relies on remote services that could receive your repository contents. Before installing or running: (1) confirm where scans are executed (local vs remote) and read the MCP/npx endpoints' privacy/data-retention terms; (2) avoid running deep-scan modes until you know which API key/environment variables are required and how they are used; (3) prefer self-hosting the MCP server or running the CLI in an isolated sandbox if you must scan private code; (4) do not provide repository secrets or wide-scoped tokens to the tool; (5) if the MCP URL or domain looks unfamiliar (the worker.dev host here), treat it as untrusted until you can verify ownership. If you need higher assurance, request the maintainer to declare required env vars, provide a reproducible local install flow, and document data handling.
Capability Analysis
Type: OpenClaw Skill
Name: open-code-review
Version: 1.0.0
The skill bundle is classified as suspicious because it directs the AI agent to use an external MCP server hosted on a Cloudflare Workers domain (v2ray-seins.workers.dev) that uses a name associated with proxy/circumvention software, which is highly unusual for a code analysis tool. The instructions in SKILL.md encourage the agent to execute remote code via 'npx @opencodereview/cli' and to send source code to this third-party endpoint for 'deep scans' (L2/L3 levels). While these capabilities are consistent with the stated purpose of AI code review, the combination of remote execution and the suspicious naming of the backend infrastructure poses a significant risk of data exfiltration or supply chain compromise.
Capability Assessment
Purpose & Capability
The SKILL.md content matches the advertised purpose (code scanning for AI-specific defects) and references appropriate tooling (an npm CLI, L1–L3 scan levels). However, deeper-scan modes explicitly require an 'Ollama or API key' yet the skill metadata declares no required credentials — an incoherence worth flagging.
Instruction Scope
The instructions instruct use of an npx CLI and an MCP server (either a URL on a third-party worker.dev domain or via 'npx -y @opencodereview/mcp-server'). Running these will cause code and dependency downloads and may send repository code off-host for processing. The SKILL.md does not state data handling, retention, or privacy guarantees, so the agent could unintentionally transmit source code or secrets to external endpoints.
Install Mechanism
There is no formal install spec (instruction-only), but the guide expects dynamic installs via npx and suggests an MCP URL hosted at 'open-code-review-mcp.v2ray-seins.workers.dev' — a non-standard domain (v2ray name) rather than an official release host. Dynamic npx installs and calling an external MCP endpoint are moderate-to-high risk because they fetch and execute remote code at runtime.
Credentials
SKILL.md mentions 'requires Ollama or API key' for deeper scans but the skill metadata lists no required environment variables or primary credential. This mismatch means the skill may need API keys or secrets in practice but doesn't declare them up front, which is incoherent and increases the chance of ad-hoc credential use or accidental leakage.
Persistence & Privilege
The skill does not request always-on inclusion, does not declare config path access, and does not appear to request elevated or persistent platform privileges. Default autonomy is allowed (normal) but not combined with other elevated flags.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install open-code-review - After installation, invoke the skill by name or use
/open-code-review - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: AI code quality scanner for CI/CD. Detects hallucinated imports, phantom packages, stale APIs, security anti-patterns, and over-engineering.
Metadata
Frequently Asked Questions
What is Open Code Review?
Scan AI-generated code for hallucinated packages, stale APIs, security anti-patterns, and over-engineering. Use when: (1) reviewing PRs with AI-generated cod... It is an AI Agent Skill for Claude Code / OpenClaw, with 295 downloads so far.
How do I install Open Code Review?
Run "/install open-code-review" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Open Code Review free?
Yes, Open Code Review is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Open Code Review support?
Open Code Review is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Open Code Review?
It is built and maintained by raye-deng (@raye-deng); the current version is v1.0.0.
More Skills