Professional pre-deployment code review and quality enforcement. Ensures imports are valid, tags are closed, and logic follows best practices before announci...

This skill aims to perform pre-deploy code checks, which is reasonable, but its instructions are vague about scope and implicitly encourage reading environment variables, ports, and logs — potentially exposing secrets. Before installing: (1) Ask the author to list exactly which env vars, files, and ports the skill will check and to limit scope to the repository or specific paths. (2) Run it in an isolated/staging environment first, not on production systems. (3) Prefer a variant that invokes specific static-analysis tools or scripts (with reviewed code) rather than open-ended agent instructions. (4) If you allow autonomous invocation, restrict the agent's access rights (filesystem and environment) so the skill cannot read unrelated secrets. If the author cannot clarify the exact scope, treat the skill with caution and consider rejecting it until it declares precise required inputs and allowed paths.

Type: OpenClaw Skill Name: code-quality-guard Version: 1.0.0 The skill's stated purpose is benign (code quality). However, the instruction 'Environment Audit: Verify required env vars and ports' in SKILL.md is vaguely worded and could be interpreted by an AI agent as a prompt injection to enumerate or access environment variables from the agent's host system, rather than just those relevant to the code being reviewed. This presents a vulnerability for unintended information disclosure, classifying it as suspicious due to the potential for exploitation.