Project Router

Terminal-first project bootstrapper and workspace context manager. Use when the user asks for /project-style workflows: detect current project, read project context/brief, run standardized targets (build/test/lint/deploy), init a .project bundle via plan/apply, manage artifacts, or expose these actions via MCP server mcp-project-router and CLI project.

This skill implements a local project CLI and an MCP server wrapper but shows several red flags you should address before installing: (1) The MCP server expects the 'project' binary at /home/safa/clawd/bin/project — there are no install steps; ensure you know where the CLI will be installed and adjust that path. (2) SKILL.md mentions Trello sync and a SQLite canonical DB, but the included code does not implement them; treat those features as untrusted/unfinished. (3) Running 'project target run' will execute arbitrary shell commands from .project/targets.json with the agent's environment—inspect targets.json before executing, and avoid running this skill in directories containing secrets or as a privileged user. (4) The search and other commands read repository files; be careful if those files contain sensitive information. If you plan to use this skill: request or provide clear install instructions, replace the hardcoded PROJECT_BIN with a configurable path, audit .project/targets.json and any planned commands, and do not run it with elevated privileges. My confidence is medium; additional information that would raise confidence: an explicit install script/instructions, removal of hardcoded paths, or confirmation that Trello/DB integrations are intentionally omitted or provided with secure credential handling.

Type: OpenClaw Skill Name: project-router Version: 1.0.0 The skill is classified as suspicious due to the `scripts/project.js` file executing user-defined commands from `.project/targets.json` using `child_process.spawnSync` with `shell: true`. This capability, found in the `runTarget` function, allows for arbitrary command execution if the `targets.json` file within a project bundle is compromised. Furthermore, these executed commands inherit the agent's `process.env`, potentially exposing sensitive environment variables. While this functionality is plausibly needed for a project management tool, it represents a significant security risk without clear malicious intent from the skill author.