Review

Final code review and quality gate — run tests, check coverage, audit security, verify acceptance criteria from spec, and generate ship-ready report. Use whe...

This skill is coherent with its stated purpose, but before installing or running it consider: (1) it will run tests/builds which execute project code — run it only on code you trust or in a sandbox/CI runner; (2) it will edit project docs (it checks and updates spec.md checkboxes) so review commits/changes after a run; (3) it searches for secrets (grep patterns) but does not request credentials — nevertheless ensure secrets are not stored in the repo; (4) confirm you grant only the needed tools (Read, Grep, Bash, Glob, Write, Edit, and the listed MCP tools) and restrict access to sensitive projects if needed. If you want extra safety, run this skill in an isolated environment (container/CI job) and review its edits before merging.

Type: OpenClaw Skill Name: solo-review Version: 1.1.1 The skill is classified as suspicious due to its extensive use of the `Bash` tool for executing various commands, including `grep` for potentially sensitive patterns like `sk_live`, `sk_test`, and `password` in source files. While the stated purpose is a security audit, this capability (found in SKILL.md) inherently carries a risk of information disclosure if the agent's output or environment is compromised. Additionally, the skill initiates network calls to external services (e.g., Vercel, Cloudflare, Fly.io logs) and modifies the git repository, which, while aligned with its review function, expands the attack surface. There is no clear evidence of intentional malicious behavior like unauthorized data exfiltration to third-party domains or persistence mechanisms, but the high-risk capabilities warrant a 'suspicious' classification.