Task Review Workflow

Standard PR review and merge workflow for task-driven development. Use when reviewing a programmer agent PR linked to a task, deciding merge vs change reques...

This skill is an instruction-only PR review checklist and looks coherent, but before installing consider: (1) Ensure the agent/environment that will run this skill actually has repository access and the right to check out branches, run tests, and perform merges — grant the minimum necessary permissions. (2) The workflow references a REVIEW_CHECKLIST.md that isn't included; make sure that file exists in your repo or provide the checklist. (3) Post-merge Trello actions will require Trello access (API key/token or another Trello integration); the skill doesn't request credentials, so plan how the agent will authenticate (or perform the Trello steps manually). (4) If you want fully automated merges and branch deletions, audit who/what has merge rights and consider gating merges behind CI. If you want more assurance, request the skill author to document exact repo/Trello integration requirements or provide a version that declares needed environment variables.

Type: OpenClaw Skill Name: task-review-workflow Version: 0.1.0 The skill is classified as suspicious due to instructions in `SKILL.md` that direct the AI agent to "Check out the PR branch" and "Run relevant test/lint/build commands." This workflow step, while common in human-driven development, represents a significant supply chain vulnerability for an automated agent. It implies the agent will execute code from an untrusted source (the PR branch) in its environment, which could lead to arbitrary code execution if a malicious PR is submitted. While there is no explicit malicious intent within the skill's instructions, this capability poses a high risk of exploitation.