QA Architecture Auditor

Perform forensic-level codebase analysis and generate comprehensive Quality Assurance and Testing Strategy Reports. Acts as Independent Principal QA Architec...

This skill appears internally consistent and implements a local forensic QA analyzer. Before running it: (1) point it at the exact repository path or git URL you intend to analyze (don’t pass root or unrelated directories), (2) be aware that if you analyze a private remote repo git will use your SSH keys or HTTPS token for authentication, and (3) if you have sensitive/proprietary code you may want to inspect scripts/analyze_repo.py yourself (it is included) to confirm behavior. The code shows some minor duplication/inefficiencies but no signs of hidden network calls or credential exfiltration beyond normal git operations. If you need higher assurance, review the full Python script line-by-line or run it in a sandboxed environment first.

Type: OpenClaw Skill Name: qa-architecture-auditor Version: 1.1.0 The qa-architecture-auditor skill is a static analysis tool designed to perform forensic codebase reviews and generate QA strategy reports. While its core functionality is aligned with its stated purpose, the script 'scripts/analyze_repo.py' is classified as suspicious due to a lack of output sanitization during HTML report generation. Specifically, repository metadata such as file paths and module names are inserted directly into the HTML template without escaping, creating a Cross-Site Scripting (XSS) vulnerability if the tool is used to analyze a maliciously crafted repository. No evidence of intentional harmful behavior or data exfiltration was identified.