Speckit Workflow for Openclaw

Complete Spec-Driven Development (SDD) orchestrator for OpenClaw. Initializes SpecKit and manages the full engineering lifecycle.

This skill appears to do what it says (orchestrate Spec-Driven Development) and ships useful templates and bash scripts, but it will write files into your repository, create feature branches, and update many agent-specific files (CLAUDE.md, QWEN.md, .github/agents/..., .cursor rules, etc.). Before installing or enabling automated git operations: 1) Run it in a disposable or test repository first so you can observe what files it creates/overwrites; 2) Back up any existing agent configuration files or templates in your repo; 3) Confirm the agent asks you for explicit permission before performing git commit/push/branch creation and only grant that permission if you trust it; 4) If you do not want repository changes, choose 'No' to automated git operations — the skill will still write files locally but should not perform git commands if the agent follows the SKILL.md; 5) If you use other agent tooling, review update-agent-context.sh to see exactly which files it will create/update and adjust or sandbox accordingly. If you want me to, I can extract the list of all files the scripts may touch (including the truncated files) and point out exact lines that create/modify them.

Type: OpenClaw Skill Name: speckit-workflow Version: 1.0.3 The skill bundle is designed for a complex development workflow, involving extensive file system modifications, Git operations (commits, pushes, branch creation), and external API calls (to GitHub for issue creation). While the main SKILL.md explicitly prompts the user for consent before performing Git operations, and subskills include safeguards like read-only modes and URL validation for external calls, several shell scripts (`check-prerequisites.sh`, `common.sh`, `setup-plan.sh`, `update-agent-context.sh`) use `eval $(get_feature_paths)`. This pattern, even with attempted sanitization, is a known shell injection vulnerability (RCE risk) if an attacker could control the input to `get_feature_paths`. Additionally, `update-agent-context.sh` uses `sed -i` with constructed patterns, which can also be vulnerable to injection. These vulnerabilities, though not indicative of malicious intent within the skill itself, pose significant risks if exploited, classifying the skill as suspicious.