Code Review

AI-powered code analysis via LogicArt — find bugs, security issues, and get logic flow visualizations. Use when reviewing code, analyzing code quality, findi...

This skill legitimately sends code to a remote analyzer (LogicArt). Before installing or using it, consider: only submit non-sensitive code (remove keys, passwords, and private data first); verify the destination (https://logic.art) and its privacy policy; test with small, harmless samples first; if you must analyze private repos, prefer a local/static analyzer or a service that supports private/authenticated uploads; monitor network activity if you want to ensure no unexpected data is being sent. If you need higher assurance, ask the publisher how they handle, store, and delete submitted code and whether they support on-prem or authenticated endpoints.

Type: OpenClaw Skill Name: quack-code-review Version: 1.0.0 The skill is suspicious due to a Local File Inclusion (LFI) vulnerability in `scripts/analyze.mjs`. The script accepts a `--file` argument, which is directly used in `readFileSync` without sanitization, allowing an attacker (via prompt injection to the agent or direct execution) to read arbitrary local files. The content of these files is then exfiltrated by being sent to the external `https://logic.art/api/agent/analyze` endpoint, posing a significant data exfiltration risk. While the stated purpose is code analysis, the lack of input validation turns a legitimate function into a critical vulnerability.