Code Refactor

Analyze code quality issues, detect code smells, and automatically apply refactoring suggestions with preview, apply, and rollback support.

This skill appears to do what it claims: analyze and propose/apply refactorings locally. Main cautions: 1) The validator runs 'npm test' (child_process) in the repository — that will execute whatever scripts are defined in package.json, which could run arbitrary code. 2) The applier writes changes to files and creates .backup files; although a rollback is provided, always inspect the generated diff before applying. Recommendations: run the skill in dry-run mode first, review the generated plan and diffs, run it on a copy/branch or in a sandbox, verify package.json test scripts before allowing non-dry-run operations, and keep version control so you can revert if needed.

Type: OpenClaw Skill Name: yuyonghao-code-refactor Version: 0.1.0 The skill bundle implements a code refactoring assistant that includes high-risk capabilities such as file system modification (src/applier.js) and arbitrary command execution (src/validator.js). Specifically, the `TestValidator` class uses `child_process.execSync` to run test commands, which is a potential vector for command injection if the command or environment is manipulated. While these behaviors are functionally aligned with the stated purpose of refactoring and validating code, they constitute significant security risks. No evidence of intentional malice, data exfiltration, or prompt injection was found.