Sigmaflow Deploy

Deploy the SigmaFlow SvelteKit trading frontend to the Git repository. Use when building and deploying changes to the SigmaFlow application, including after...

This skill appears to perform a legitimate deployment, but it embeds a plaintext Git token (and Git URL) directly in scripts rather than using declared environment variables or secret management. Before installing or running: (1) do not use the embedded token—replace it with a properly scoped token stored in an env var or secret store and update the script/metadata to declare that env var; (2) verify the token's scope and rotate it if you suspect it was leaked; (3) review the repository being cloned and its package.json for untrusted dependencies (npm install runs arbitrary build-time code); (4) avoid running this script on sensitive hosts or under high-privilege accounts; (5) consider running it in an isolated CI runner or container and audit network access to git.homelab. The mismatch between declared requirements (none) and a hardcoded credential is the primary reason to treat this skill with caution.

Type: OpenClaw Skill Name: sigmaflow-deploy Version: 1.0.0 The skill bundle contains a hardcoded GitLab authentication token (c865b793f09a3b79b65ebdfbd75c5b17395188d2) in both SKILL.md and scripts/deploy.sh. While the documentation explicitly acknowledges this security risk and the script targets a local 'homelab' environment, embedding plaintext credentials and passing them via URLs are high-risk practices that facilitate credential exposure. No clear evidence of intentional malice or exfiltration of the user's local secrets was found.