Openclaw Skill Clawban

Kanban Workflow is a TypeScript skill for a stage-based agentic co-worker that integrates PM platforms via CLI-first adapters (CLIs or small wrapper scripts)...

This skill appears to be a genuine CLI-first Kanban integrator, but there are a few mismatches and practical risks to consider before installing: - Metadata vs reality: The registry metadata claims no required binaries or env vars and no install step, but the repository and SKILL.md require Node/npm (npm ci) and adapter CLIs (gh, planka-cli, plane, curl, jq). Expect to run npm ci and to install adapter CLIs yourself. - Credentials: If you enable the Plane or Linear adapters you will need PLANE_API_KEY/PLANE_WORKSPACE or LINEAR_API_KEY. The linear wrapper script (scripts/linear_json.sh) sends LINEAR_API_KEY in an Authorization header to api.linear.app — review that script and only provide API keys you trust and scope to least privilege. - Privilege inheritance: The skill shells out to platform CLIs and acts with the same permissions those CLIs or API keys have. Ensure CLI sessions and tokens are scoped appropriately (least privilege) before using the skill. - Cron/install behavior: The skill can optionally install an autopilot cron job. If you use that option, verify what it writes (the cron entry and command) and ensure it runs in an environment with only the credentials you intend. - Review scripts and code: The included scripts (linear_json.sh, planka_whoami_json.mjs) and TypeScript files are readable; scan them to confirm there are no unexpected network destinations or obfuscated logic. There are no scanner flags in the provided data, but the metadata inconsistencies above warrant manual review. Recommended actions: review the two wrapper scripts and package.json, run npm ci in an isolated environment if you plan to execute locally, provide adapter API keys only when necessary and with least privilege, and avoid using the autopilot cron install until you have inspected what it will create.

Type: OpenClaw Skill Name: openclaw-skill-clawban Version: 0.1.6 The skill is classified as suspicious due to multiple command injection vulnerabilities across its adapters. User-controlled input (e.g., work item titles, bodies, labels, IDs, project IDs, state IDs) is passed directly as arguments to external CLIs (gh, plane, planka-cli, and the scripts/linear_json.sh wrapper) without explicit sanitization. While `execa` is used to prevent shell injection, it does not prevent argument injection into the target CLI's own parsing logic. This vulnerability is present in `src/adapters/github.ts`, `src/adapters/linear.ts`, `src/adapters/plane.ts`, `src/adapters/planka.ts`, and potentially in `src/cli.ts` when installing the OpenClaw cron job. The skill's transparently declared privilege inheritance model (executing with the full privileges of the underlying CLIs) amplifies the impact of these vulnerabilities.