regexguard

Regex safety & correctness analyzer -- detects catastrophic backtracking, portability errors, correctness bugs, maintainability issues, anchoring problems, a...

What to consider before installing: - Review the scripts in this skill (already included) before enabling hooks in your repos — the code is local shell scripts that will be sourced/executed during commits if you install the lefthook hooks. - The skill reads a license key from REGEXGUARD_LICENSE_KEY or ~/.openclaw/openclaw.json; treat that file and the env var as sensitive. If you prefer, keep the license in an environment variable rather than a persistent config file. - The license checker optionally uses CLAWHUB_JWT_SECRET (not declared in metadata) only for signature verification — ensure you don't have an unexpected secret set with that name. - Installing hooks modifies repository configuration (adds lefthook.yml and runs lefthook install). That is expected but persistent; only install hooks in repositories where you trust the skill and its source. - No network calls or telemetry were found in the code; still, if you need absolute assurance, run the scripts manually (bash scripts/dispatcher.sh scan .) in a controlled workspace to observe behavior before enabling hooks.

Type: OpenClaw Skill Name: regexguard Version: 1.0.2 RegexGuard is a regex safety and correctness analyzer designed to detect anti-patterns like ReDoS (Catastrophic Backtracking) and portability issues in local codebases. The tool implements a tiered licensing system using offline JWT validation (found in `license.sh`) and provides Git integration via `lefthook` (managed in `dispatcher.sh`). Analysis of the shell scripts (`analyzer.sh`, `dispatcher.sh`) confirms that all scanning and license checks are performed locally without network exfiltration or suspicious execution patterns. The tool's behavior, including reading the OpenClaw configuration for API keys and installing git hooks, is entirely consistent with its stated purpose as a developer utility.