Nm Attune Mission Orchestrator

Lifecycle orchestrator that auto-detects project state and routes to the correct development phase

This skill appears to implement what it claims, but its runtime instructions expect local git and the GitHub CLI and will read and modify repository files and create issues on GitHub. Before installing or running it: (1) Confirm who will run the skill and what git/GitHub credentials that agent has. (2) Expect it to write .attune/mission-state.json and possibly edit artifact files—keep backups or run in a fork/isolated repo. (3) If you do not want automatic issue creation, use the --no-auto-issues flag or avoid --auto. (4) Ask the publisher to declare required binaries and credentials (e.g., gh, git, GITHUB_TOKEN) in the skill metadata so you can evaluate permissions. (5) If you need higher assurance, review the attune and leyline skill implementations that this orchestrator invokes to confirm they do not perform unexpected network or credential access.

Type: OpenClaw Skill Name: nm-attune-mission-orchestrator Version: 1.0.0 The skill bundle is a development lifecycle orchestrator that manages project phases from brainstorming to execution. It is classified as suspicious due to a potential shell injection vulnerability in 'modules/phase-routing.md'. The instructions direct the AI agent to extract 'Out of Scope' items from project documents and pass them directly into a 'gh issue create' shell command without specifying input sanitization or escaping. This could allow an attacker who can influence the project's documentation (e.g., via a pull request) to execute arbitrary commands on the user's system if the agent executes the command naively.