Sovereign Codebase Onboarding

Codebase onboarding assistant that maps project architecture, identifies patterns, generates guides, and helps new developers understand any repository in mi...

This skill appears coherent for repository analysis: it reads manifests, source files, CI, and Docker/README to build an onboarding guide and asks for no credentials or installs. Before installing, consider: (1) only grant the agent access to repositories you are comfortable having analyzed (don’t expose private secrets like .env files or credentials), (2) review the full SKILL.md/EXAMPLES to confirm it won't be pointed to any external endpoints in your deployment, and (3) if your agent platform allows scoping skills to specific repos or read-only file sets, restrict access to limit exposure. If you want extra assurance, test the skill on a public or sanitized repo first.

Type: OpenClaw Skill Name: sovereign-codebase-onboarding Version: 1.0.0 The skill is designed for comprehensive codebase analysis and onboarding, which inherently requires broad access to the file system (reading various configuration files, source code, and directory listings) and the ability to generate 'copy-paste commands' for setup and common tasks. While these capabilities are necessary for its stated, benign purpose, they present a significant attack surface for prompt injection. A malicious user could potentially craft a prompt to instruct the AI agent to read sensitive files outside the intended scope or generate and suggest harmful commands, making the skill 'suspicious' due to its exploitable capabilities, rather than 'malicious' as it does not contain explicit instructions for intentional harmful behavior within its own definition.