Xie Code Review

Automated code review assistant. Analyzes code changes, PRs, and files for quality issues, best practices, security concerns, and style violations. Provides...

This skill appears to be a local static analysis/code-review tool and is coherent with its description. Before using it: (1) review the full analyzer.py (the provided snippet was truncated) to verify there are no network calls, subprocesses, or eval/exec of untrusted code; (2) when adding the pre-commit hook, point to the repository-relative script path (not an arbitrary absolute path) and consider running it in CI with limited permissions; (3) run the tool locally in a sandboxed environment initially (or inspect generated reports) to confirm behavior; (4) avoid running unknown third-party tools on systems holding sensitive credentials or secrets until you’ve audited them.

Type: OpenClaw Skill Name: xie-code-review Version: 1.1.0 The skill bundle is a legitimate automated code review tool designed to analyze Python, JavaScript, and C/C++ code for quality, style, and security issues. The core logic in `scripts/analyzer.py` uses AST parsing and regex-based heuristics to detect common vulnerabilities such as hardcoded secrets, SQL injection, and dangerous functions (e.g., `eval`, `strcpy`). The Git integration in `scripts/main.py` uses standard `subprocess` calls to identify changed files, and the `SKILL.md` instructions are strictly aligned with the tool's stated purpose without any signs of prompt injection or malicious intent.