SchemGuard

Detect breaking changes in OpenAPI specs. Use when reviewing API changes, validating PRs that modify API specs, checking backward compatibility, or linting O...

This skill appears coherent for checking OpenAPI compatibility. Before installing or running it: (1) verify the npm package @sethclawd/schemaguard (owner, popularity, source code, recent release) because npx will fetch code from the registry at runtime; (2) be cautious running the --mcp server mode — check what network ports it binds to and whether it requires authentication; (3) run the tool in a sandbox or CI runner with limited permissions when first testing; and (4) avoid pointing it at sensitive files or credentials until you review the package source or vendor reputation.

Type: OpenClaw Skill Name: schemaguard Version: 0.1.2 The skill is classified as suspicious due to its reliance on `npx` to download and execute an external package (`@sethclawd/schemaguard`) from the npm registry, as seen in `SKILL.md`. This introduces a significant supply chain risk, as the content of the external package is not directly controlled by the skill bundle and could be compromised or altered over time, potentially leading to the execution of malicious code. While the stated purpose of the commands appears benign (schema diffing, linting), the execution model delegates trust to an external, mutable dependency.