Upstream Recon

Investigate an open-source project before interacting with it — PRs, issues, or comments. Use BEFORE: filing an issue, submitting a PR, or commenting on an e...

This skill appears to do what it claims (analyze a repo's issues/PRs/maintainer behavior), but it assumes the `gh` CLI is installed and will use the agent's GitHub authentication (which could include access to private repos). Before installing or invoking it: ensure you have `gh` installed and understand which GitHub account/token the agent will use; do not run it if you don't want the agent to query private repositories with your credentials. Ask the skill author to update the manifest to declare `gh` as a required binary and to document that it uses the agent's GitHub auth; if you need stricter isolation, run these `gh` queries yourself or in an environment with limited credentials.

Type: OpenClaw Skill Name: upstream-recon Version: 1.0.0 The skill bundle defines a legitimate GitHub reconnaissance task using the `gh` CLI. The `SKILL.md` provides clear instructions for the AI agent on how to gather repository metadata, contributor information, and analyze issues/PRs. There are no instructions for data exfiltration, malicious execution, persistence, or obfuscation. While the use of user-provided arguments (`<owner/repo>`, `[topic-keyword]`) with shell commands (via `gh` CLI) could introduce a shell injection vulnerability if the agent's underlying implementation lacks proper input sanitization, the `SKILL.md` itself does not contain any malicious instructions or prompt injection attempts designed to exploit such a vulnerability or subvert the agent's behavior. The instructions are aligned with the stated purpose and do not exhibit intentional harmful behavior.