Shadows Deploy Guardian

Pre-deployment verification checklist — tests, types, build, secrets scan, environment validation. Use before pushing to production or staging.

This skill appears to be what it says — a pre-deployment checklist — but it will run your repo's tests/builds/linters and inspect git history. Those operations can execute arbitrary code from the repository and may print secret-like strings to stdout. Before installing or invoking: 1) run it on a cloned or sandboxed copy (not directly in a production environment); 2) ensure CI/runner environment isolates network and credentials; 3) be aware the secrets-scan uses grep and can echo matched text to logs — use a dedicated secret scanner (gitleaks/detect-secrets) for production-sensitive work; 4) note minor docs issues (it references DEPLOY_URL and Docker but Docker isn't listed in required bins, and 'docker build --dry-run' is not a standard docker flag) — review and adapt the commands to your environment before running. If you want higher assurance, request a version with explicit opt-in checks and no direct stdout of potential secrets.

Type: OpenClaw Skill Name: shadows-deploy-guardian Version: 1.1.0 The skill provides a pre-deployment verification framework that executes high-risk operations, including running arbitrary project scripts (e.g., 'npm test', 'cargo build') and making outbound network requests via 'curl' to user-defined URLs in SKILL.md. While these actions are clearly aligned with the stated purpose and the documentation includes explicit security warnings regarding sandboxing and secret exposure in logs, the inherent risk of remote code execution and network access from untrusted repositories meets the threshold for a suspicious classification.