repo-mini-practice

Use when a user wants to learn a GitHub or local codebase by understanding its implementation principles, creating a minimal runnable practice version, or tu...

This skill looks like a genuine 'make a minimal learning project from a repo' helper, but it asks the agent to fetch repositories and run demos/tests — which can cause it to execute untrusted code. Before installing or enabling this skill: (1) require explicit user confirmation before the agent fetches or executes remote code or runs tests; (2) run the skill only in an isolated sandbox/container with no access to sensitive credentials or host resources; (3) consider disabling implicit/autonomous invocation or require explicit invocation so it can't fetch/run code without your permission; (4) be cautious when pointing it at private repos or repos containing build scripts, CI, or native binaries; (5) if you plan to let it use tools like git, rg, or docker, ensure those tools and their access tokens are managed intentionally. If the owner/publisher is unknown and you cannot run the agent in a safe sandbox, treat this skill as higher risk.

Type: OpenClaw Skill Name: repo-mini-practice Version: 1.0.0 The skill bundle is designed to help users learn codebases by creating minimal, runnable versions of existing repositories. While the intent appears educational, SKILL.md (Step 7) explicitly instructs the agent to 'Run the demo or tests' to verify the implementation. This instruction to execute code, combined with the ability to fetch and inspect external repositories (Step 1), constitutes a high-risk capability that could lead to arbitrary code execution if the agent is directed toward a malicious repository. No evidence of intentional malice, data exfiltration, or hidden backdoors was found.