RepoMedic

Safely triage and remediate GitHub dependency hygiene issues with explicit guardrails. Use when Dependabot PRs fail, pnpm lockfiles break, transitive vulnerabilities appear (e.g., glob/lodash/brace-expansion), or CI/Vercel fails due to dependency resolution. Prioritize low-risk fixes, branch+PR workflow, and plain-English explanations.

This skill appears to do what it says: triage and apply low-risk dependency fixes using a branch+PR workflow. Before installing, confirm the agent/platform will: (1) grant only the repository-scoped read/write access you intend (branch-only write), (2) provide access to CI/Vercel logs if needed, and (3) have pnpm/npm/yarn available to run installs. Ask how credentials are supplied (platform token vs. environment variables) and require human approval for medium/high risk actions. Note the small inconsistency: the skill expects package-manager commands but the registry metadata lists no required binaries — verify availability of those tools in your environment. Prefer running the skill in a forked repo or protected branch so changes are visible as a PR before merging.

Type: OpenClaw Skill Name: repomedic Version: 1.0.6 The OpenClaw AgentSkills bundle 'repomedic' is classified as benign. The `SKILL.md` file, which contains instructions for the AI agent, explicitly defines strong safety guardrails, a least-privilege policy, and non-negotiable 'must NOT' actions. These include never pushing directly to main/master, requiring a branch+PR workflow, limiting local workspace access to the target repository, and preventing external actions or modification of files outside the target repo. While the skill requires capabilities like file modification and command execution (e.g., `pnpm`/`npm`/`yarn`), these are essential for its stated purpose of dependency remediation and are heavily mitigated by the explicit safety instructions, approval gates, and risk labeling, demonstrating a clear intent to operate safely and prevent malicious behavior.