ai-code-reviewer

Functional for its intended goal (multi-model AI code review plus local secret scanning) but exhibits moderate supply-chain and privacy risks. The biggest issues: ambiguous/possibly third-party 'Codex CLI' instruction, lack of explicit user consent and redaction/allowlist controls before sending code externally, and undocumented persistence/encryption of cached analysis. These gaps increase the chance of accidental data exposure when used on sensitive repositories. Recommended mitigations before use on sensitive code: require explicit user consent and per-run confirmation for external sends, provide provenance and verified install URLs/checksums for CLIs, implement file/dir/regex allowlist/denylist and redaction for secrets prior to external transmission, and encrypt and restrict access to the SQLite cache (or avoid persisting raw code).