Repo Kanban PM

Install and enforce a lightweight product-management workflow inside a code repo: feature-as-kanban boards, ROADMAP status tracking, branch/PR conventions, a...

This skill appears to do what it promises (create ROADMAP/KANBAN templates and patch AGENTS.md). Before using it: 1) Inspect the two scripts in the repo and test them in a safe environment (a disposable clone or container). 2) If you enable the optional cron, be aware it schedules an autonomous agent run that may call `gh` and run `npx` in the repo — these actions can fetch code or network resources and will include the repo path in the cron announcement. Only enable the cron if you trust the OpenClaw environment/agent (`persey`) and the `openclaw` CLI behavior. 3) If you cannot trust autonomous agents or need stricter control, run init_repo_pm.sh manually and do not add the cron, or remove/adjust the cron message so it doesn't instruct potentially unsafe commands. 4) Consider adding the created documentation via a PR so maintainers can review changes to AGENTS.md and docs before merging.

Type: OpenClaw Skill Name: repo-kanban-pm Version: 0.1.1 The skill is classified as suspicious due to the `scripts/add_daily_pm_cron.sh` script, which creates an OpenClaw cron job. This cron job instructs the AI agent to execute external commands like `gh pr list` and `npx tsc --noEmit` as part of its daily PM review process. While these commands are presented as 'lightweight checks' and align with the stated purpose, instructing an AI agent to execute arbitrary external shell commands represents a significant risky capability, even without clear evidence of malicious intent like data exfiltration or backdoors. The `SKILL.md` and other scripts primarily set up documentation and workflow rules, which are benign.