Sen Dev Patterns

个人开发提效Skill - 沉淀页面布局、样式风格、代码模块、算法库、踩坑记录。适用于用户需要复用个人开发经验、遵循统一规范、调用已沉淀的计算口径或模块的场景。

This skill is mainly a collection of docs, templates and helper scripts and appears legitimate for its stated purpose. However the included publisher scripts will try to find GitHub/Gitee tokens automatically (environment variables, VSCode storage, git credential helper) and then set git remotes that embed those tokens before pushing. Before running any publish script: 1) Inspect publish_skill.py and publish_gitee.py yourself to confirm you understand what they do. 2) Prefer to provide a token explicitly (as an environment variable you control) rather than letting the script hunt for stored credentials. 3) If you run the scripts, check .git/config afterwards and remove any remote URLs containing tokens; rotate any tokens that were embedded. 4) Only run these scripts in a trusted environment (or a copy/clone of the repo) and avoid running them if you don't want tools to access your IDE or git credential storage. 5) If you want publishing convenience without risk, manually create repos and push using your normal git tooling instead of running the automated scripts.

Type: OpenClaw Skill Name: sen-dev-patterns Version: 0.1.0 The bundle contains publishing scripts (publish_skill.py and publish_gitee.py) that exhibit high-risk behaviors, including an intrusive credential discovery mechanism that searches for GitHub tokens in environment variables, Git credentials, and VSCode's internal global storage (%APPDATA%\Code\User\globalStorage\github-auth-token). Furthermore, these scripts contain hardcoded usernames ('sinadook' and 'the13ai') in API check endpoints and Git remote URLs, which could lead to code being pushed to unintended accounts if executed. While these scripts are framed as repository management utilities, the automated harvesting of sensitive tokens combined with hardcoded target accounts is highly irregular and poses a significant security risk.