AI Dev Runtime

AI Dev Runtime tools - read_file, search, edit, run_terminal, run_tests (hybrid semantic+keyword search, learning memory)

This appears to be a developer tooling integration that expects an AiDevRuntime HTTP service and will send code snippets and prior 'memory' to that service. Before enabling: 1) Confirm where AI_DEV_RUNTIME_URL will point — prefer running the service locally (localhost) rather than a remote/third-party host. 2) Treat AI_DEV_RUNTIME_API_KEY as a secret if used; ask the maintainer to declare required env vars in the manifest. 3) Ask what exact data the runtime receives and whether it persists or shares code snippets or sensitive files. 4) If you cannot verify the server or its operator, avoid pointing the URL to an external host because the agent may transmit repository contents and past fixes (which can include secrets). 5) Consider requesting a manifest update that explicitly lists AI_DEV_RUNTIME_URL and AI_DEV_RUNTIME_API_KEY and documents what data flows to the runtime and retention policies.

Type: OpenClaw Skill Name: ai-dev-runtime Version: 0.5.0 The skill bundle defines high-risk capabilities including arbitrary terminal command execution (run_terminal), file system modification (edit, apply_patch), and reading local files (read_file) via a local HTTP server (defaulting to localhost:8000). While these tools are aligned with the stated purpose of an 'AI Dev Runtime' in SKILL.md, the broad permissions granted to the AI agent to execute shell commands and access the file system represent a significant attack surface for potential abuse or accidental damage, fitting the criteria for suspicious risky capabilities.