Production Code Audit

Deep-scan a codebase, understand its architecture and patterns, then produce a comprehensive audit report with prioritized fixes. Optionally apply changes on...

This skill generally does what it says (read a repo, report issues, optionally make fixes), but there are important ambiguities you should resolve before installing or granting access: 1) Clarify secret handling — the doc both forbids committing secrets and shows an example that removes a secret and commits the change. Decide whether you want automated secret-removal and what review/approval is required. 2) Confirm how PRs/branch pushes will be performed and what credentials are required; only grant a token with the minimum scope (e.g., repo:public_repo or repo-specific write) and avoid org-wide admin tokens. 3) Require an explicit, interactive confirmation step before any 'fix mode' actions (create branch, modify files, run tests, push). 4) Prefer that test execution happen in a CI sandbox you control rather than on a developer workstation. 5) Always review the diff/PR before merging and consider running the first audit in read-only mode to see the scope of changes the skill proposes. If you cannot verify those behaviors with the skill owner, treat the 'fix' capability as high-risk and use the skill for read-only audits only.

Type: OpenClaw Skill Name: production-code-audit Version: 1.1.0 The skill bundle contains conflicting instructions in SKILL.md that encourage extreme AI autonomy, explicitly telling the agent to "not ask questions," "not wait for instructions," and "fix everything automatically" without user input. While the stated purpose is a code audit and hardening tool, these instructions override the earlier safety guidelines regarding user confirmation for test execution and file modification. This creates a high risk of unintended code execution or destructive modifications if the agent processes a codebase without human oversight.