SEVO Pipeline

SEVO — Agent 研发流水线。Spec-Execute-Verify-Operate: the agentic software delivery lifecycle for AI agent software production. Covers 8 stages from specification...

What to check before installing: - Confirm host dependencies: README expects Node.js, the OpenClaw CLI and an existing ~/.openclaw/openclaw.json. The registry metadata omits those—don't assume a safe default. - Inspect scripts/init.sh and index.js (plugin entry) before running the installer: the init script will register the plugin in openclaw.json, enable hooks and restart the gateway. Back up openclaw.json first. - Review the prompt-injection behavior: the plugin relies on before_prompt_build injection and recommends setting hooks.allowPromptInjection=true. If you are uncomfortable with automated prompt injection, keep that flag disabled or run the plugin in a sandbox first. - Audit for network / remote execution: search the codebase for outbound network calls (fetch/axios/http/https), child_process.exec/spawn, or hard-coded endpoints. Run the code in an isolated test environment or container if possible. - Use a safe deployment strategy: first run in a non-production OpenClaw instance or test workspace (empty agent pool), verify the plugin’s degraded/no-op behavior when dist/ compiled artifacts are absent, and confirm logs (logs/sevo-pipeline-events.jsonl) before enabling on production. - Principle of least privilege: limit the plugin's workspace permissions, and review what directories it will create (projects/sevo, data, logs). Consider running with only explicit agents configured (avoid single-agent mode where 'main' would execute all stages). Reason for suspicion: the package is internally coherent for its purpose, but the registry listing understates required host dependencies and the runtime instructions direct privileged configuration changes and prompt injection — all explainable, but worth an explicit human review and cautious, sandboxed rollout.

Type: OpenClaw Skill Name: sevo Version: 0.2.1 SEVO is a comprehensive and well-architected framework for managing the AI agent software delivery lifecycle (SDLC). The bundle includes a core engine (TypeScript), an OpenClaw plugin (JavaScript), and a Next.js dashboard for monitoring. While the plugin requires high-privilege permissions such as 'allowPromptInjection' and modifies the 'openclaw.json' configuration via 'scripts/init.sh', these actions are strictly aligned with its stated purpose of automating workflow transitions and injecting stage-specific instructions. The code demonstrates high engineering standards, including detailed Architecture Decision Records (ADRs) and extensive test suites. No evidence of data exfiltration, malicious persistence, or unauthorized remote execution was found.