open-code-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill tells the agent to "stop and ask the user for credentials" and then shows commands and environment-variable exports with a placeholder (e.g., ocr config set ... , export OCR_LLM_TOKEN=), which implies the agent would need to embed the secret verbatim into generated commands or output — an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repo contains runtime curl/git installs that fetch-and-execute remote content: scripts/install.sh runs sh -c "$(curl -fsSL "https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh")" (scripts/install.sh:49) and git-clones "https://github.com/alibaba/open-code-review.git" for --method source (scripts/install.sh:56), and references/cicd-and-plugins.md shows curl commands that download a remote command file (https://raw.githubusercontent.com/alibaba/open-code-review/main/plugins/open-code-review/commands/review.md) which would inject agent slash-command instructions at runtime (references/cicd-and-plugins.md:35-41).