Qoder CLI skill

Delegate coding tasks to Qoder CLI using Print mode (non-interactive). Use when: (1) building/creating new features or apps, (2) code reviews, (3) refactorin...

This skill is essentially a wrapper for the qodercli command-line tool — that is expected. Before installing or using it, verify the source and integrity of the qodercli binary (where was it downloaded from?), and confirm you trust that tool. Be aware that SKILL.md references QODER_PERSONAL_ACCESS_TOKEN but the skill metadata doesn't declare it as required — you will likely need to supply a personal access token for operations. The skill documents a '--yolo' flag that skips permission checks and examples that perform automatic code edits; avoid using such flags unless you fully understand and accept the risk. Also review and control any ~/.qoder/agents or project agent files the skill creates, since they can grant persistent behavior (including running Bash) in future runs. If you want this to be safer: require explicitly declaring the auth env var in the skill metadata, confirm qodercli's provenance, and prefer running commands with review/CI gates rather than automatic edit flags.

Type: OpenClaw Skill Name: qoder-cli-skill Version: 0.1.0 The skill bundle is classified as suspicious due to the integration of a powerful CLI tool (`qodercli`) with high-risk capabilities that could be exploited via prompt injection. Specifically, the `SKILL.md` documentation explicitly highlights and provides examples for the `--yolo` flag, which 'Skips permission checks' within `qodercli`, allowing potential bypass of internal safeguards. Additionally, the ability to add arbitrary MCP servers using `bash command:"qodercli mcp add <name> -- <command>"` allows the agent to execute `npx` commands to install and run any npm package (potentially malicious ones) with auto-confirmation (`-y`), creating a significant attack surface for arbitrary code execution or unauthorized system modifications.