Scanned skills

alirezarezvani/claude-skills code-reviewer

Checked the catalogued skill at code-reviewer.

SkillTrust corpus scan 14 September 2026 v0.10.0 via skillsh Verify on GitHub
D AI-triaged 1
A Security

A set by no findings on this axis

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

A Transparency

A set by no findings on this axis

1 finding
permission_hygienehigh SD-003
expected_outputs/sample_c_clean_quality.json
8 suppressed by AI triage
permission_hygienehigh SD-003 benign_example
README.md

The path /tmp/check.json is a harmless temporary file used in a README example, not a security vulnerability.

permission_hygienehigh SD-003 benign_example
README.md

The path /tmp/check.json is a harmless temporary file used in a README example, not a security vulnerability.

permission_hygienehigh SD-003 benign_example
expected_outputs/sample_c_smells_quality.json

Absolute path in sample data, not used for file operations by the skill.

permission_hygienehigh SD-003 benign_example
expected_outputs/sample_csharp_clean_quality.json

The absolute path points to a file within the skill's own workspace, not a system directory, and is not an attacker-controlled input.

permission_hygienehigh SD-003 benign_example
expected_outputs/sample_csharp_smells_quality.json

The absolute path points to a file within the skill’s own directory, not a system directory, so it does not pose a real threat.

permission_hygienehigh SD-003 benign_example
expected_outputs/sample_java_clean_quality.json

The absolute path is only a data reference in an expected output file, not executed by code.

permission_hygienehigh SD-003 benign_example
expected_outputs/sample_java_smells_quality.json

The absolute path is only present in data, not used for file access.

securityhigh SD-007 benign_example
languages/php.md

The matched text is documentation about missing curl_close, not an actual outbound network call in code.