Auto Prodcution

用「评分表驱动迭代」方法把项目做到生产级别。每次输入 /vibe-coding 启动，自动打分、修复、循环直到满足生产就绪阈值。

This skill is coherent with its stated purpose but has two practical risks you should consider before installing or running it: (1) It will automatically modify and commit files in your repo without per-change confirmation. Run it only on a fork/branch or a disposable clone, or modify the workflow to produce diffs for human review instead of committing. (2) It expects many external CLI tools (semgrep, trivy, govulncheck, npm/pip-audit, gocyclo, etc.) but does not declare them; ensure these are installed in a controlled environment. Additional precautions: back up your repo, run in a sandbox or CI job with limited permissions, review the VIBE_SCORECARD.md and every proposed commit before merging, and avoid running this on repositories that contain secrets or production credentials. If you want safer operation, require interactive confirmation before commits or change commit commands to create branches/PRs instead of direct commits.

Type: OpenClaw Skill Name: vibe-innovative-idea-first-and-use-this-skill-to-production-automatically Version: 1.0.0 The skill implements an autonomous 'vibe coding' workflow that iterates on project quality and security. It requires broad permissions to execute shell commands (e.g., semgrep, trivy, npm audit, curl) and perform automated git commits. Most notably, SKILL.md contains explicit instructions for the agent to bypass user confirmation ('do not ask whether to continue'), which is a high-risk behavior that removes human oversight for potentially destructive operations. While the behavior is aligned with the stated purpose, the combination of shell access and the instruction to override safety prompts warrants a suspicious classification.