Python Auto Dev

Automates Python code generation, testing, debugging, and optimization within a configured conda environment, managing all project files at H:\code\Daily.

This skill appears to do what it says, but before installing consider: (1) It will create and execute code under H:\code\Daily and will import modules (which runs module-level code) — do not point it at directories containing sensitive or untrusted code. (2) It activates a conda env and spawns subprocesses inheriting your environment variables — secrets present in your environment could be exposed to child processes or to project code. (3) Confirm the hard-coded conda path and env (Windows-only) or edit the scripts to match your setup. (4) There is a minor inconsistency about auto-patching: SKILL.md says automatic patching (with confirmation) while references say auto-patching is disabled — review debug_code behavior before allowing automatic modifications. (5) If you plan to run this on important machines, run it first in an isolated VM or sandbox and back up the H:\code\Daily workspace.

Type: OpenClaw Skill Name: python-auto-dev Version: 1.0.0 The skill bundle provides a framework for automated Python development but contains significant security vulnerabilities. Specifically, `run_tests.py` and `optimize_code.py` use `subprocess.run` with `cmd.exe /c` to execute shell commands constructed via string concatenation, which is a classic shell injection risk. While the scripts appear designed for a legitimate developer workflow in a specific Windows environment (using hardcoded paths like `C:\anaconda3` and `H:\code\Daily`), the pattern of invoking the shell to run tests and linters is high-risk. No evidence of intentional malice, data exfiltration, or persistence was found.