Deploy Next.js sites to Netlify with approval gates. Supports soilrichbyjohn.com and Synergy salon.

This skill mostly does what its name says (build and run Netlify deploys from local repos), but there are gaps you should resolve before installing: - Confirm how Notion logging is supposed to work: the SKILL.md says it will create entries in a 'Deploy History' database but the skill does not declare a Notion API token or network permission for notion.so. Ask the author where the Notion credential is expected to come from (env var, platform secret, or interactive prompt). Do not provide your Notion token until this is clarified. - Verify Netlify credentials: the SKILL.md expects netlify-cli login. That stores credentials locally; ensure you want the agent to use your Netlify account and that the platform will enforce the approval gate before running commands that affect production. - Check declared permissions vs registry metadata: the SKILL.md requests file access to ~/soilrich-website and ~/synergy-website and uses tools like jq, but the registry metadata shows no required env vars and no required binaries. Ask the publisher to update metadata so the platform can present accurate permission prompts. - Confirm availability of needed tools: logs flow uses jq but jq is not listed in commands; ensure jq is present or the instruction is adjusted. - Treat rollback as destructive: the skill runs netlify rollback. Keep the explicit user-approval requirement and consider restricting who can confirm rollbacks. If you can't get satisfactory answers to the above, run the skill in a restricted environment (or remove the Notion logging step) until the author fixes the mismatches.

Type: OpenClaw Skill Name: site-deployer Version: 1.0.0 The OpenClaw AgentSkills skill bundle is classified as benign. Its purpose is clearly defined as deploying Next.js sites to Netlify, with scoped file and network permissions (`~/soilrich-website`, `~/synergy-website`, `api.netlify.com`, `github.com`). Critical actions like `deploy` and `rollback` explicitly require user approval, which is a strong security measure against prompt injection or accidental execution. The only minor oversight is the use of `jq` in the `deploy logs` command without it being explicitly listed in the `commands` permissions, but this is a functional dependency for log filtering and does not indicate malicious intent or a security vulnerability in this context.