repo runner

Bootstrap and run a GitHub project by following its docs (README/docs), with safeguards for untrusted install/run steps. Use when the user gives a GitHub rep...

This skill is internally consistent and behaves like a helper that inspects a repository and recommends safe commands. It does not itself exfiltrate secrets or require credentials. However, it is designed to run install/build/run commands you may approve — which can execute arbitrary code from the repository. Before approving destructive or networked operations (git pull, installs, curl | bash, docker compose, etc.), review the repo's README and the specific commands the skill proposes. Prefer running untrusted projects inside an isolated environment (container or VM), avoid auto-applying .env values (provide secrets out-of-band), and deny any installation or postinstall scripts you don't understand. If you want a higher assurance check, ask for the exact commands the skill will run and inspect them line-by-line before consenting.

Type: OpenClaw Skill Name: repo-runner Version: 1.0.2 The 'repo-runner' skill is designed to execute untrusted code from GitHub repositories, which is an inherently high-risk operation. While the `SKILL.md` explicitly instructs the AI agent to 'ask for confirmation' before running `npm install` or 'any `curl | bash`', this still allows for Remote Code Execution (RCE) if the user is tricked into confirming a malicious script from the untrusted repository. The auxiliary scripts (`scripts/detect_project.sh`, `scripts/suggest_node_commands.sh`) are for analysis and suggestion only, not direct execution of untrusted code, and do not show malicious intent. The primary concern is the explicit instruction in `SKILL.md` to allow `curl | bash` with user confirmation, which represents a significant vulnerability, classifying it as suspicious rather than benign, but not malicious as there's no evidence of intentional self-exploitation or hidden harmful behavior by the skill itself.