mini-swe-agent

Autonomously run complex software engineering tasks like bug fixes or feature implementation using the mini-swe-agent CLI with full codebase edits.

This skill tells the agent to run an unknown 'mini' CLI with an explicit autonomous flag ( --yolo ) to edit your codebase. Before installing or invoking it: 1) Do not run or install any 'mini' binary unless you can verify its source (official repo/releases, checksums, or vendor). 2) Ask the skill author for the 'mini' binary's provenance and inspect its code or release artifacts. 3) Require the skill to declare required binaries and any credentials it needs, and to limit scope (specific repo/paths/branches). 4) If you must test, run it in an isolated sandbox or disposable VM, on a cloned repo/branch with backups and no push permissions. 5) Prefer a skill that performs edits via transparent commands (git diffs, PRs) and explicit user confirmation rather than an opaque autonomous CLI. These steps will reduce risk of destructive edits or data exfiltration.

Type: OpenClaw Skill Name: mini-swe-agent Version: 1.0.0 The skill instructs the OpenClaw agent to execute an external, undefined command named `mini` using a bash tool. The `SKILL.md` explicitly mandates the use of the `--yolo` flag, ensuring this command runs autonomously without user intervention. While the skill itself does not contain malicious code, its reliance on an external, unverified executable combined with autonomous execution creates a significant vulnerability. If a malicious `mini` binary were present in the agent's environment (e.g., via PATH hijacking or a compromised installation), this skill would facilitate its execution, posing a high risk of arbitrary code execution or system compromise.