Openclaw Rd Pipeline

Orchestrate OpenClaw end-to-end R&D delivery in Feishu from requirement intake to closure using PM, developer, reviewer, and tester subagents. Use when handl...

Do not install or enable this skill before getting clarifications and making configuration changes. Specifically: 1) Ask the author to list exactly which credentials and tokens are required (Feishu API token(s), Git account/token, CI credentials, any other service tokens) and to add them to requires.env/primary credential so you can review and provision scoped secrets. 2) Confirm where repository pushes and PRs will be made (which org/repo and which account) and insist on least-privilege tokens (repo-scoped, non-admin) and an audit trail. 3) Ask how Feishu access is scoped and whether chat/wiki reads are limited to the project group; sensitive chat history should be excluded or restricted. 4) Verify the dependency on the external "Superpowers" skill and review its permissions. 5) Test in a sandbox project with revoked or limited credentials before using in production. The validate_status_flow.py script appears benign (it only checks state transitions), but the orchestrated network/write operations require explicit, scoped credentials and documentation before this skill should be trusted.

Type: OpenClaw Skill Name: openclaw-rd-pipeline Version: 1.0.0 The skill bundle outlines a legitimate R&D workflow. However, the `SKILL.md` instructs the OpenClaw agent to execute `scripts/validate_status_flow.py` directly via `bash` with arguments. This direct shell execution (`bash <script> <args>`) introduces a potential shell injection vulnerability if the arguments (e.g., `--from-status`, `--to-status`, `--file`) are derived from untrusted user input without proper sanitization by the OpenClaw agent's runtime. While the Python script itself is benign and there is no evidence of intentional malicious behavior within the skill bundle, this execution pattern represents a significant security risk.