React Native Update (Pushy) Integration

Unified integration skill for React Native Update / Pushy（统一入口）across OpenClaw and Claude Code workflows. Use for 安装配置, appKey/update.json 接线, iOS/Android 原生...

This appears to be a legitimate React Native / Pushy integration helper. Before using it: (1) verify you have Node/npm (and CocoaPods for iOS) available locally — the playbook and doctor rely on them; (2) review update.json and sensitive appKey values locally (the skill reads that file but does not send data externally); (3) avoid blindly running global installers from the playbook (e.g., `npm i -g`) without understanding them — prefer local installs when possible; (4) run the included `scripts/integration_doctor.sh` in a safe, local checkout or sandbox to see its output; and (5) if you will let the agent run commands autonomously, limit that to a trusted agent/context because instruction-only skills can still execute shell commands on your behalf.

Type: OpenClaw Skill Name: react-native-update Version: 0.3.0 The skill bundle is classified as suspicious due to the direct instruction in `SKILL.md` for the AI agent to execute a local shell script (`scripts/integration_doctor.sh`). While the script's intent is diagnostic and its current implementation does not show malicious behavior (e.g., no exfiltration, no unauthorized network calls), the execution of shell commands (`cd`, `grep`, `node -e`) by the agent represents a risky capability. This capability, if combined with an agent vulnerability (e.g., unsanitized user input for `<app-root>`), could potentially lead to shell injection or other command execution vulnerabilities, even though the skill itself does not contain explicit malicious code.