Release Guard

Guard skill releases with pre-publish validation, quality checks, and safety gates. Use before publishing any skill to ensure it meets minimum standards, pas...

This skill appears to be a local, bash-based pre-release checker and is not obviously malicious, but several things don't add up and you should be cautious: - Documentation vs implementation: SKILL.md claims Node.js and detailed security/dependency scans; the included scripts are pure bash and do not perform dependency or vulnerability scans. Ask the author to clarify or provide the promised scanners (or supply steps to install the optional security-auditor). - Odd rule: SKILL.md requires 'No Chinese characters in documentation' — this is discriminatory and unexpected. The scripts do not enforce it; ask why that rule exists and consider whether you want such a restriction enforced in your pipeline. - Minor risks: the main script uses eval to run condition strings (currently with static inputs) and will chmod files in --fix mode; run it on a copy or in CI sandbox first to verify behavior. The secret-detection is a simple grep which can produce false negatives/positives — do not rely on it as a full secret scanner. Recommendations before installing or using widely: - Run the scripts on a non-production copy of a skill directory to observe behavior. - Request clarification from the publisher about the Node.js requirement and about where/what security scans are executed; if they intend to include an external 'security-auditor', get its source or install instructions. - If you plan to enable auto-fix, review the fix actions (mkdir, chmod) to ensure they are acceptable for your CI/host environment. - Prefer running this inside an isolated CI job or container rather than on a developer workstation until you validate it. If the author provides a corrected SKILL.md (remove inaccurate Node.js claim, document any external tools used) and/or integrates a real vulnerability scanner, confidence in coherence would increase.

Type: OpenClaw Skill Name: release-guard Version: 1.0.0 The skill is a validation utility for other OpenClaw skills but contains a shell injection vulnerability in `scripts/release-check.sh`. The script's `check` function uses `eval` on strings containing the user-provided directory path (`$SKILL_DIR`) without sanitization, which could allow arbitrary command execution if the script is run on a maliciously named directory. While the logic appears intended for legitimate quality assurance, the use of `eval` on external input is a high-risk implementation flaw.