Repo Onboarding

Onboard a repo by assessing architecture and dependencies, setting up roadmap and kanban for execution, and generating a comprehensive onboarding report.

This skill tells your agent to run Python/bash scripts that are not included and are referenced by absolute paths in another user's home directory — those scripts could execute anything on your machine. Before installing or running: (1) inspect the exact scripts referenced (/home/.../senior-architect and repo-kanban-pm) to confirm their safe behavior; (2) ensure the scripts exist in a trusted location (prefer relative paths inside the repo or bundle the scripts with the skill); (3) require and document needed binaries (python, bash) and any env vars those scripts need; (4) do not run the add_daily_pm_cron.sh step until you review what it writes to crontab; (5) run first in an isolated environment or CI job with limited privileges. If you cannot review the referenced scripts, treat this skill as untrusted.

Type: OpenClaw Skill Name: repo-onboarding Version: 0.1.0 The skill bundle is classified as suspicious primarily due to the instruction in `SKILL.md` to execute `add_daily_pm_cron.sh`, which creates a cron job. While presented as an 'Optional daily PM audit', the ability to establish persistence via cron is a high-risk capability. This action, even if intended for a legitimate purpose, introduces a significant vulnerability risk if the underlying script or the agent's interpretation could be exploited for unauthorized execution or persistence. The skill also relies on executing other external scripts from absolute paths within the OpenClaw workspace, making its security dependent on those external components.