Sovereign Project Guardian

Project health and best practices enforcer. Checks security, quality, documentation, CI/CD, and dependencies. Produces a letter grade (A-F) with actionable f...

This skill is coherent and does what it claims: it inspects a repository and reports problems. Before running it, consider: (1) run it against a copy or non-sensitive checkout if your repo contains secrets you don't want processed; the skill will scan all files and could surface secrets in its report; (2) expect it to recommend or run local audit tools that may require network access or installed tooling; (3) only allow the agent access to repos you trust, and monitor any outbound network activity from the agent if you are concerned about sensitive data leaving your environment. If you prefer, run the checks locally (using the examples in EXAMPLES.md) rather than granting the agent direct repository access.

Type: OpenClaw Skill Name: sovereign-project-guardian Version: 1.0.0 The skill is designed to audit project health, including security vulnerabilities like hardcoded secrets and insecure dependencies. While its intent is benign, the `SKILL.md` instructs the AI agent to 'recommend running `npm audit`, `pip-audit`, `govulncheck`, `cargo audit`'. An agent might interpret this as an instruction to execute these external commands. If the agent's execution environment lacks robust input sanitization or sandboxing when running such commands, it could introduce a shell injection vulnerability, allowing for arbitrary command execution. This represents a significant vulnerability risk, classifying it as suspicious rather than benign, despite the lack of clear malicious intent for data exfiltration or persistence.