Mini PIV - Lightweight Feature Builder

Lightweight PIV workflow - discovery-driven feature builder. No PRD needed. Asks quick questions, generates PRP, executes with validation loop. For small-to-medium features when you want to skip PRD ceremony.

This skill appears coherent for orchestrating small feature work: it will read the codebase, create PRP files under PROJECT_PATH/PRPs, run validation commands (linters, tests), and can commit changes using git. Before installing or running it, consider: 1) Run it on a non-sensitive or backed-up repository first — it writes files and may commit changes. 2) Review generated PRP/implementation outputs before allowing executor sub-agents to run or commit. 3) Confirm the platform's sessions_spawn sub-agents are trusted, since those sub-agents will get file-system access to your project. 4) Note the minor inconsistency in Step 2 about whether to spawn a sub-agent — that could lead to unexpected behavior; ask the publisher for clarification. 5) Because the instructions allow web searches and external CLI tools if available, restrict execution to an environment with controlled network access if you are concerned about external I/O. If you want a stricter assessment, provide the actual project you plan to run it against or the platform policy for sessions_spawn and sub-agent capabilities — that would change the confidence level.

Type: OpenClaw Skill Name: mini-piv Version: 1.1.0 The skill is classified as suspicious due to its broad system access capabilities, which, while plausibly needed for its stated purpose as a feature builder, inherently carry a higher risk. It instructs the agent and sub-agents to execute various shell commands (`git`, `ls`, `tree`, build/test/lint commands), perform extensive file system operations (read, write, modify project files), and utilize network access for web searches and the `gh` CLI for 'GitHub code search, repo exploration' (in `references/codebase-analysis.md`, `references/execute-prp.md`, `references/generate-prp.md`). While no clear evidence of intentional malicious behavior (e.g., data exfiltration to unauthorized endpoints, persistence, or explicit harmful prompt injection) was found, these powerful capabilities could be misused. Additionally, the owner/repo name 'SmokeAlot420' (in `_meta.json` and `SKILL.md`) is a minor non-technical flag.