Nm Sanctum Workflow Improvement

Retrospective evaluation and improvement of skills, agents, commands, and hooks

This skill appears to do what it says (collect workflow context, propose improvements, and create GitHub issues), but several practical and safety gaps exist. Before installing or running it: - Verify runtime tools: ensure git and the GitHub CLI (gh) are installed and authenticated, and confirm the 'memory-palace', 'review-room', and 'pensive' utilities the instructions reference are available in your environment. The skill metadata does not declare these dependencies. - Review and restrict automatic writes: the module defaults to automatic issue creation. If you don't want the agent posting to your repositories, run with the documented opt-out (--no-auto-issues or SKIP_AUTO_ISSUES=true) or change the workflow to require an explicit --create flag. - Confirm credentials and scope: ensure gh is authenticated to the intended account/repo, and consider using a token with limited scope or a sandbox repository for testing. The skill does not declare required env vars (e.g., GITHUB_TOKEN) or repository targets. - Audit what gets posted: issue bodies may include file paths, PR text, and error messages. Remove or redact sensitive snippets before auto-creating issues. - Suggested improvements to the skill owner: declare required binaries (git, gh), require or document the auth method (GITHUB_TOKEN or gh auth), make auto-creation opt-in by default, and add explicit repository/label configuration to avoid accidental writes. If you want, I can produce a checklist or a small wrapper that enforces 'dry-run' by default (print would-be issue bodies instead of creating them) so you can safely evaluate the skill first.

Type: OpenClaw Skill Name: nm-sanctum-workflow-improvement Version: 1.0.0 The skill bundle facilitates workflow optimization through shell execution, git operations, and automated GitHub issue management. A significant security concern is identified in SKILL.md (Step 7.2), which instructs the agent to post 'tooling learnings' to a hardcoded external GitHub repository (athola/claude-night-market) regardless of the user's current project context, creating a potential path for accidental data leakage or unauthorized telemetry. Additionally, the automated issue creation logic in modules/auto-issue-creation.md grants the agent broad authority to interact with the GitHub CLI (gh) and create issues automatically, which increases the risk of unintended external communication.