Reckit

Bulletproof AI code verification. The agent IS the engine — no external tools required. Spawns parallel verification workers that slop-scan, type-check, muta...

This skill mostly does what it says (a multi-gate verification framework) but has several red flags you should handle before installing or running it: 1) Source/provenance: The skill source/homepage are unknown. Prefer skills with a traceable repo and maintainer. 2) Audit the scripts first: review scripts/* and assets/dashboard/server.mjs for any network endpoints, telemetry, or destructive file operations before running. The package contains many shell scripts that will be executed — read them. 3) Telemetry: locate scripts/telemetry.sh and grep for network POST/PUT/ curl/ fetch calls. If telemetry is present, ask what is sent and to where; disable it if you don't want data leaving your host. 4) Run in a sandbox: initially run the skill in an isolated environment (container, disposable VM, or a dedicated non-sensitive workspace) because it will scan project directories (default ~/Projects) and can write .wreckit/ and generated CI files. 5) Tooling expectations: it attempts to detect and (optionally) invoke external tools (stryker, mutmut, valgrind, etc.). Ensure you understand and control what it will install or execute; prefer installing required tools yourself in a controlled way or rely on the AI fallbacks only after inspection. 6) Agent config & spawning: it asks for agent subagent spawning (maxSpawnDepth, children limits). Only enable these features if you understand the platform subagent model and are comfortable with autonomous subagent execution. 7) Least privilege: avoid running this skill on systems with secrets, credentials, or production data. If you must audit sensitive repos, isolate them and disable any telemetry/network calls. If you want, I can: (A) scan the scripts for network calls and list lines that call curl/fetch/sockets/telemetry, (B) summarize what each script will modify on disk, or (C) produce a minimal safe-run checklist (commands to run the skill in a container and what to mount).

Type: OpenClaw Skill Name: wreckit-ralph Version: 2.4.0 The wreckit-ralph bundle is a highly sophisticated and comprehensive defensive security auditing suite designed to verify AI-generated code. It includes a wide array of scripts for Static Application Security Testing (red-team.sh), dependency hallucination detection (check-deps.sh), mutation testing, and dynamic analysis. While the bundle requires high-privilege execution (shell access) to run project tests and build tools, its logic is consistently aligned with its stated purpose of code verification and quality assurance. The documentation (SKILL.md) includes specific 'Anti-Fabrication' protocols to prevent AI agents from hallucinating results, and the 'Codex CLI' notes, while suggesting high-risk sandbox bypasses for specific environments, are framed as technical workarounds rather than malicious intent.