Skills scar-code-review
install
source · Clone the upstream repo
git clone https://github.com/openclaw/skills
Claude Code · Install into ~/.claude/skills/
T=$(mktemp -d) && git clone --depth=1 https://github.com/openclaw/skills "$T" && mkdir -p ~/.claude/skills && cp -r "$T/skills/aibenyclaude-coder/tetra-scar-code-review" ~/.claude/skills/clawdbot-skills-scar-code-review && rm -rf "$T"
manifest:
skills/aibenyclaude-coder/tetra-scar-code-review/SKILL.mdsource content
scar-code-review
What this does
A code review system that learns from its own misses. Two layers work together:
-
Checklist review — Regex/heuristic checks across 4 dimensions:
- Security: SQL injection, hardcoded secrets, XSS, eval/exec
- Performance: N+1 queries, missing pagination, unbounded SELECTs
- Correctness: Unchecked nulls, off-by-one patterns, unhandled promises
- Maintainability: Long functions, deep nesting, magic numbers
-
Scar reflex arc — Pattern-matching against past review misses. When a review fails to catch a bug that later causes an incident, record a scar. Next time, the reflex fires before the LLM even looks at the diff.
No external dependencies. stdlib only. Python 3.9+.
Quick start
Review a file:
python3 scar_code_review.py review path/to/file.py
Check a diff against past scars:
python3 scar_code_review.py check-diff path/to/changes.diff
Record a missed review finding:
python3 scar_code_review.py record-miss \ --what-missed "Missed SQL injection in user input handler" \ --pattern "execute.*format.*user" \ --severity critical
File format
JSONL, compatible with tetra-scar:
{"id":"rscar_1234","what_missed":"...","pattern":"...","severity":"critical","created_at":"..."}
Integration
from scar_code_review import review, reflex_check, record_miss, load_review_scars # Review a file findings = review("app/views.py") for f in findings: print(f"{f['severity']} [{f['dimension']}] {f['message']} (line {f['line']})") # Check diff against past scars scars = load_review_scars() blocks = reflex_check(diff_text, scars) for b in blocks: print(f"BLOCKED: {b}") # Record a miss after an incident record_miss( what_missed="Missed unvalidated redirect", pattern="redirect.*request\\.GET", severity="high", )