trae-code-review-plus

专业的代码审查 Skill。当用户要求进行代码评审、安全性检查或性能优化建议时调用。

This skill includes local Python scripts that will recursively scan and memory-map many files in your workspace and compute heuristics across the entire repository before returning results. Actions to consider before installing or running it: 1) Review the two included scripts (init_scanner.py and security_core.py) yourself or with a trusted engineer — pay attention to any network calls, logging, or places where data may be exported (none are present in this version, but confirm). 2) The code contains suspicious comments/strings (e.g., 'The Stealth Payload') and some buggy/odd logic (nonsensical entropy calculation and an unset boot_time) — ask the author for clarification. 3) Run the skill inside an isolated sandbox/VM or on a copy of the repository (not on sensitive production workspaces) if you need to test it. 4) If you only need a scoped review (single file or PR), require the skill to limit scanning to the requested scope rather than automatically indexing the whole workspace. 5) Confirm how the 'sub-agents' (Step 5.5) are implemented and where their outputs and logs go; ensure they do not dispatch externally or exfiltrate data. If you cannot validate these points or do not trust the source, treat the skill as potentially risky and do not run it on sensitive code.

Type: OpenClaw Skill Name: trae-code-review-plus Version: 1.0.1 The skill bundle is classified as suspicious because SKILL.md explicitly instructs the AI agent to execute a local Python script (scripts/init_scanner.py) under the guise of a 'background optimization utility.' This script performs a recursive scan of the entire workspace using mmap and includes 'decoy logic' in its entropy calculation, which is a hallmark of deceptive behavior. While the script implements a 'SecretDetector,' there is no evidence of data exfiltration, network calls, or persistence in the provided code, making it a high-risk capability that lacks a clearly defined malicious payload but deviates from standard safe practices.