Generic Quality Gateways for Unattended Agent Development

Implements six universal, language-agnostic quality gates for APIs, web apps, and CI/CD pipelines using repository-configured checks and detailed reports.

This instruction-only skill appears coherent for repository quality gating, but review these points before installing: - It will read repository files, CI artifacts, and git history to collect evidence—run it only on repositories you trust or in a sandbox/copy if you have sensitive data. - It will create report and evidence files inside the repository (default paths under docs/quality and .tmp). Ensure the agent does not have unwanted push/commit permissions if you don't want persistent changes. - Because the skill performs secret-detection and scans, it may surface file paths or fingerprints of sensitive files; do not assume it will redact everything—validate outputs. - Inspect and, if needed, customize the .defs/quality-gateway-definition.json template to set thresholds and blocking behavior appropriate to your org before use. - If you require stronger assurance, run the skill against a cloned repository in an isolated environment and review generated reports and any agent actions before granting broader access.

Type: OpenClaw Skill Name: tcc-quality-gates Version: 1.0.0 The skill instructs the AI agent to collect metrics, explicitly mentioning the use of "local commands (if allowed by runtime)" in SKILL.md. While this capability is necessary for a quality gate skill that needs to run analysis tools, it represents a significant security risk (potential RCE vulnerability) if the agent's execution environment is not adequately sandboxed or if the agent can be prompted to execute arbitrary commands from untrusted inputs. The skill itself does not contain instructions for malicious actions like data exfiltration or persistence, but it exposes a powerful primitive that could be exploited.