Squad Control

Integrate with Squad Control kanban for AI agent task orchestration. ⚠️ Security note: This skill handles GitHub tokens and API keys by design — it clones pr...

What to check before installing: - Confirm the registry metadata is updated: SKILL.md requires SC_API_URL and SC_API_KEY but the registry lists none — ask the publisher to fix this. - Prefer a workspace-scoped SC_API_KEY instead of an account-scoped key unless you intentionally need multi-workspace polling. Account-scoped keys can expose per-workspace githubToken fields (write access to repos). - Review the included scripts yourself (poll-tasks.sh, poll-parser.py, tests). They perform network calls and git operations — inspect and run tests in an isolated environment first. - The setup instructs storing SC_API_KEY in ~/.openclaw/openclaw.json and creating cron jobs; understand that this persists a sensitive secret on disk. Consider protecting that file, using least-privilege keys, and rotating tokens regularly. - The SKILL.md references a wake-listener script (scripts/wake-listener.sh) that is not in the bundle — ask the publisher for the missing file or an updated SKILL.md to avoid runtime surprises. - If you will allow the skill to spawn local sub-agents or call the local gateway, audit and restrict SC_WAKE_LOCAL_GATEWAY_TOKEN / gateway.token usage and ensure your OpenClaw runtime is secured. - If you do not fully trust the Squad Control instance, do not provide account-scoped keys or allow the skill to persist credentials. When in doubt, keep keys workspace-scoped and grant minimal GitHub PAT scopes.

Type: OpenClaw Skill Name: squad-control Version: 1.4.0 The squad-control skill is a high-privilege orchestration tool designed to automate agent workflows, including cloning private repositories, spawning sub-agents, and performing automated git merges. While its behavior is aligned with the stated purpose of integrating with squadcontrol.ai, it possesses significant high-risk capabilities: it fetches task descriptions and agent personas ('soulMd') from a remote API to dynamically generate prompts for sub-agents, and it includes logic for automated PR merging and 'stuck task' recovery. These features, primarily defined in SKILL.md and executed via scripts/poll-tasks.sh and scripts/poll-parser.py, create a large attack surface for remote prompt injection and unauthorized code modification if the remote API is compromised.