Tech Debt Tracker

Scan codebases for technical debt, score severity, track trends, and generate prioritized remediation plans. Use when users mention tech debt, code quality,...

This skill seems to implement a legitimate tech-debt scanning + prioritization workflow, but exercise caution before running it against real repositories or adding it to CI: - Review the scanner/prioritizer/dashboard scripts (scripts/debt_scanner.py, scripts/debt_prioritizer.py, scripts/debt_dashboard.py) before running. Search them for any code that sends data to external hosts (HTTP POST/PUT to remote endpoints, or explicit uploads). If you can't review the full source, don't run it on sensitive projects. - The package contains sample application code with hard-coded secrets (Stripe/PayPal/Square keys, a DATABASE_URL, API_KEY values). Treat these as samples only — do not assume they are safe or valid credentials. If you plan to publish or share results, remove or redact sample secrets first. - Run the tools in an isolated environment (sandbox or VM) and on a non-sensitive copy of your repository first. Verify outputs locally before enabling any integrations that post reports to Jira/Slack/GitHub or other external services. - If you will integrate into CI, require explicit configuration of connectors and inspect any code that performs automatic uploads. Only provide external-service credentials to the integrations you explicitly configure, and prefer ephemeral/scoped tokens. What would change this assessment: viewing the full content of the scripts to confirm there are no hidden exfiltration paths (e.g., hardcoded webhook URLs, telemetry uploads, or automatic remote POSTs), and confirmation from the author that included secrets are purely illustrative and that connectors are opt-in and authenticated only by user-provided credentials.

Type: OpenClaw Skill Name: tech-debt-tracker Version: 2.1.1 The tech-debt-tracker bundle is a legitimate toolset designed to identify and manage technical debt. While the included sample codebase (e.g., `payment_processor.py`, `user_service.py`, and `frontend.js`) contains numerous critical vulnerabilities such as hardcoded API keys, database credentials, and SQL injection risks, these are explicitly labeled as intentional examples of 'debt' for the scanner to detect. The core logic in `debt_scanner.py`, `debt_prioritizer.py`, and `debt_dashboard.py` focuses on static analysis, scoring, and reporting without any evidence of malicious intent, data exfiltration, or unauthorized command execution.