ReviewEvo

Self-improving code reviewer that learns your codebase over time. Analyzes git history, spots patterns, identifies risk — and gets smarter every run.

This skill generally does what it claims (uses git to analyze history and files), but it will read many repository files and write a persistent learnings file back into the repo without guidance to redact secrets or to exclude the file from commits. Before installing or invoking it: (1) run it in a disposable clone or branch to inspect behavior; (2) add .review-evo/ to .gitignore or review and remove sensitive lines from .review-evo/learnings.md before committing; (3) require the skill to ask for confirmation before reading or persisting files outside explicit review targets; and (4) if you need stronger guarantees, request the skill be updated to automatically redact secrets and to show a preview of any content it will write. If you plan to allow autonomous invocation, add the above safeguards first.

Type: OpenClaw Skill Name: review-evo Version: 0.1.1 The `SKILL.md` file instructs the agent to execute shell commands, specifically `git diff main...{branch}`, where `{branch}` is user-provided input. The skill does not include explicit instructions for sanitizing this user input before it's interpolated into the shell command. This creates a potential shell injection vulnerability, which could lead to Remote Code Execution (RCE) if the OpenClaw agent does not perform adequate input sanitization. While the commands are intended for a legitimate code review purpose, the lack of input sanitization for user-controlled arguments makes the skill suspicious due to this critical vulnerability risk.