Prod Deploy

生产环境发布部署自动化技能。用于 SM 交友网站 (zmq-club.com) 的一键发布流程，包括：数据库备份、结构对比、前端构建、代码部署、迁移执行、服务重启、生产验证。Use when 沛哥要求发布生产、部署代码、上线新功能、或执行发布 SOP。

Do not run or install this skill in a production environment as-is. Specific actions to take before considering use: - Treat the exposed IP/username/password in SKILL.md and scripts as compromised: rotate the SSH password/keys on the server immediately if these files were shared or uploaded. - Do not supply production credentials directly in skill files; replace hardcoded credentials with secrets managed by a vault or environment variables and document required env vars in the skill manifest. - Verify and fix the deploy.py file — it appears truncated/malformed (the __main__ block is incomplete) and paramiko is used but not declared as a dependency. - Review the code line-by-line to ensure it does only the intended deployment actions (no hidden network calls or exfiltration). Run in a staging environment first. - Prefer SSH key auth, least-privilege accounts (not root), and an audited CI/CD pipeline instead of running one-click scripts from an agent with embedded credentials. - If you cannot verify the origin of this skill (source/homepage unknown), avoid granting it access to production credentials or allowing autonomous invocation until a trusted audit is completed.

Type: OpenClaw Skill Name: prod-deploy Version: 1.0.1 The skill bundle contains hardcoded root SSH credentials (root:7758258Liu) for a production server (157.245.56.178) within SKILL.md and scripts/deploy.py. Although the scripts perform standard deployment tasks like database backups and service restarts for the site zmq-club.com, the inclusion of plaintext administrative credentials for a specific external IP address is a critical security vulnerability and highly irregular for a portable skill.