> Reviewing code with meaningless variable names is still several orders of magnitude harder than reviewing the original code though.

Automated checking tools don't really care about human-friendly user functions' names. They will however check for calls to dangerous APIs (eg: XMLHttpRequest(url), eval(stuff) ) and some dangerous patterns (eg: background actions unprompted by the user ).