OpenTangl

Not a code generator — an entire dev team. You write the vision, it ships the code. Autonomous builds, PRs, reviews, and merges across multiple repos. Point...

This skill appears internally consistent, but review and control what it can access before use: 1) Only run it against repositories you can afford to change — try a disposable/test repo first. 2) Confirm your GitHub CLI (gh) is authenticated and check what account/organization it will act as; limit token scopes if possible. 3) Inspect the generated projects.yaml and docs/environments/* files before allowing automated runs or merges. 4) Keep backups or protected branches for important repos and consider requiring human approval for merges in production branches. 5) If you want stricter guarantees, ask the agent to show every planned commit/PR and require explicit user approval before creating or merging them.

Type: OpenClaw Skill Name: opentangl Version: 0.1.10 The OpenClaw AgentSkills skill bundle is classified as benign. While it instructs the AI agent to perform file system operations (reading project configurations, writing YAML and Markdown files) and execute shell commands (e.g., `node --version`, `git --version`, `gh auth status`, `mkdir`, `echo`), these actions are explicitly aligned with its stated purpose of configuring an autonomous development agent. Crucially, the `SKILL.md` file repeatedly and explicitly instructs the agent: 'Do not run these commands on the user's behalf' for any potentially impactful commands like `git clone`, `npm install`, `gh repo create`, or starting the `autopilot`. Furthermore, it includes a strong security measure by instructing the agent not to handle API keys directly and to verify/add `.env` to `.gitignore`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent for harmful purposes.