Qa Gate Vercel

Pre-production validation gate for Vercel/Supabase/Firebase stack — generates test plans, executes test suites, validates APIs, UI, toasts, LLM output qualit...

This skill appears to do what it says (generate plans and run tests for a Vercel/Supabase/Firebase app), but there are mismatches you should resolve and safety steps you should take before using it: - Verify which environment variables are actually required. claw.json lists OPENROUTER_API_KEY, SUPABASE_URL, SUPABASE_ANON_KEY, VERCEL_TOKEN, but the registry metadata shows none — ask the author to reconcile and document all env vars. Expect additional vars like TEST_AUTH_TOKEN and VALIDATION_BASE_URL used by generated tests. - Do not provide production tokens. Create scoped, short-lived, or read-only test credentials for Supabase and Vercel and a dedicated OpenRouter/LLM key with limited quota for judge runs. - Inspect generated test files and the test-plan JSON before executing them. The skill will generate and then run tests that execute code from your repository; review for any unexpected shell commands or network calls. - Run first in an isolated environment (CI job, container, or throwaway branch) so tests cannot affect production resources or leak secrets from the machine. - If you need stricter controls, request the author to declare all env vars in SKILL.md/claw.json and add an option to only generate tests (no execution) so you can run them manually after review. Given the inconsistencies and the potential to run arbitrary project code, treat this skill as moderately risky until the above clarifications and mitigations are in place.

Type: OpenClaw Skill Name: qa-gate-vercel Version: 0.1.1 The skill implements a comprehensive QA automation pipeline that generates and executes dynamic TypeScript code via 'npx vitest' and 'npx playwright' (SKILL.md). It requires high-privilege credentials, including VERCEL_TOKEN and SUPABASE_ANON_KEY, to perform infrastructure checks and API validations. While the logic is consistent with its stated purpose as a pre-production gate, the pattern of generating and executing code that has access to administrative tokens represents a significant attack surface and high-risk operational behavior.