Reference Maintainer

Automation skill for Reference Maintainer.

This skill appears to be what it says: a documentation generator that parses source files and writes docs. Before installing or running it, review the included scripts (noted issues: reference_updater.py has a hard-coded default target 'sentiment_decay_model.py' and an indentation bug that may break execution). Important cautions: 1) Run it only on copies or non-sensitive repositories — the tool will read source files and persist extracted configuration (which can include secrets) into references/ and a log file. 2) Limit the paths you pass to the tool and inspect generated output before sharing. 3) If you plan to let an agent invoke this skill autonomously, restrict its file-system access to safe directories. If you want, I can point out the exact lines to change to avoid the hard-coded default and to inspect/escape potential secret-like values before writing them.

Type: OpenClaw Skill Name: reference-maintainer Version: 1.0.0 The skill bundle is designed as a system documentation generator but explicitly instructs the AI agent to extract and include 'credentials' in the generated reference docs (SKILL.md and references/templates/schema.yaml). While the Python scripts (scripts/universal_doc_generator.py) use standard AST parsing to extract configurations, the directive to harvest secrets and store them in 'living reference docs' for session persistence is a high-risk behavior that facilitates credential harvesting. No explicit exfiltration logic or remote endpoints were identified, suggesting this may be a misguided 'expert memory' feature rather than a targeted attack, but it remains highly irregular and dangerous.