Releaseguard

Scan, harden, sign, and verify release artifacts with ReleaseGuard — the artifact policy engine for dist/ and release/ outputs.

This skill appears internally consistent with its purpose. Before installing or running it: (1) prefer the Homebrew install if available; (2) never blindly run curl ... | sh — review the install script or download the release artifact and verify checksums/signatures from the project's GitHub Releases; (3) provide cloud tokens (RELEASEGUARD_CLOUD_TOKEN) or OIDC tokens only when you intentionally use cloud features or keyless signing; (4) ensure the releaseguard binary on PATH is the official one you vetted; and (5) remember the skill is instruction-only — it only performs actions if the agent runs the releaseguard commands or you run the installer locally.

Type: OpenClaw Skill Name: releaseguard Version: 0.1.5 The skill bundle describes a security tool for artifact hardening, but it includes high-risk installation instructions in SKILL.md that use the 'curl | sh' pattern, which is a common vector for remote code execution. While the documentation advises reviewing the script first, an autonomous agent might execute the command directly. Additionally, the _meta.json file contains an anomalous future-dated timestamp (1774412381985, corresponding to May 2026). Although no explicit malicious intent or data exfiltration was identified, these factors represent significant security risks in an agentic context.