xfire Security PR Review

Multi-agent adversarial security review — 3 AI agents debate every finding, only real vulnerabilities survive

Before installing or running this skill: 1) Be comfortable providing multiple LLM API keys and a GitHub token — if you only want one agent, confirm whether non-used keys can be omitted. 2) Use least-privilege credentials: restrict the GitHub token scope (e.g., repo:status/read or read-only) unless you intend to allow posting comments. 3) Verify the 'xfire' package on PyPI and its GitHub repo (review code, releases, and maintainers) before pip installing. 4) Run initial scans with dry-run and --debug in an isolated environment (or CI runner) and inspect any files written to XFIRE_CONFIG_PATH/XFIRE_AUTH_PATH. 5) If you need higher assurance, ask the publisher to make installing optional or to support running with a single provider key and to document exact token scopes and where auth is stored. These steps reduce risk from installation and credential exposure.

Type: OpenClaw Skill Name: xfire-security-review Version: 0.1.2 The skill bundle describes the usage of 'xfire', a multi-agent adversarial security review tool. The `skill.md` file, which serves as instructions for an AI agent, clearly defines when and how to invoke the `xfire` CLI tool with various arguments. While the `xfire` tool itself requires broad permissions (e.g., GitHub token, multiple AI API keys, access to codebases) and interacts with external services, these capabilities are explicitly stated and necessary for its legitimate purpose of performing security reviews. There is no evidence of prompt injection against the OpenClaw agent, intentional harmful behavior, unauthorized data exfiltration, or instructions to perform actions beyond the stated purpose of using the `xfire` tool for security analysis.