Wander Monitor

Guides use of Wander to monitor GitHub Actions without polling. Use when the user pushes code and wants CI notifications, asks how to watch workflows, avoid...

Before installing or enabling this skill, consider: 1) It instructs the agent to auto-run background shell scripts after each git push — review whether you want an agent to execute local scripts automatically. 2) The skill expects access to your gh CLI authentication and local files (repo tree, ~/.config/gh), but the metadata declares no credentials — verify what tokens/credentials gh exposes and limit scope. 3) The recommended install clones a third‑party GitHub repo and runs its scripts; audit the wander repo (watch-*.sh, smart-push.sh) for any network calls, data uploads, or commands that could exfiltrate secrets before running them. 4) If you want the functionality but not autonomous execution, run the scripts manually or require explicit confirmation before the agent starts background watchers. 5) If possible, ask the skill author for explicit declarations of required credentials and a signed/reputable source for the Wander tool; absence of declared env vars and the 'auto-trigger' instruction are the primary red flags here.

Type: OpenClaw Skill Name: wander-monitor Version: 1.0.3 The skill mandates an 'auto-trigger' behavior in SKILL.md, instructing the agent to automatically execute background scripts from an external repository (https://github.com/ERerGB/wander.git) after every 'git push'. It also directs the agent to modify user shell configuration files (~/.zshrc, ~/.bashrc) for persistence and environment setup. While these actions are consistent with the stated purpose of CI monitoring, the requirement for autonomous execution of external code and modification of system profiles poses a high risk of abuse.