Sprint OS

5-minute sprint operating system for AI agents. Autonomous execution cycles: ASSESS → PLAN → SCOPE → EXECUTE → MEASURE → ADAPT → LOG → NEXT. Includes optiona...

This skill appears coherent and low-risk, but take these practical steps before enabling it: (1) If you enable Convex logging, only set CONVEX_SPRINT_URL to a Convex deployment you control or trust — do not point it at unknown endpoints. (2) Review the included log-sprint.sh to confirm log file path (SPRINT_LOG_FILE) and payload format meet your privacy needs. (3) Be aware the SKILL.md instructs the agent to read 'relevant files' in the workspace — if you need to limit file/network access, run the skill in a restricted environment or sandbox. (4) If you do not want network calls, simply leave CONVEX_SPRINT_URL unset and the skill will log locally.

Type: OpenClaw Skill Name: sprint-os Version: 1.0.0 The skill requests broad 'network' permissions in SKILL.md ('any resources needed for sprint work'), which could be interpreted too broadly by an AI agent. The `scripts/log-sprint.sh` script sends user-controlled data (sprint details) to an external, user-defined `CONVEX_SPRINT_URL`. While this is an intended feature for logging, it represents a data exfiltration vector if the `CONVEX_SPRINT_URL` is compromised or maliciously configured. The script also directly interpolates user-provided arguments into a JSON payload for `curl`, which could be a vulnerability if inputs are not sanitized, though not immediately exploitable for shell injection in this specific `curl -d` context. These are risky capabilities and potential vulnerabilities, but there is no clear evidence of intentional malicious behavior.