Nm Abstract Plugin Review

Review plugin quality with tiered checks and dependency-aware scoping. Use for PR validation and pre-release audits

This skill appears coherent for repository-level plugin audits. Important cautions before running: 1) Many checks run repository tests and scripts (make test, python scripts). Those can execute arbitrary code or perform network I/O from the reviewed repo — run in an isolated/sandboxed CI worker or container when reviewing untrusted repositories. 2) The skill invokes other evaluation skills (skills-eval, hooks-eval, rules-eval); ensure those skills are installed and trusted. 3) Review any repo scripts the skill will call (update_plugin_registrations.py, generate_dependency_map.py, test suites) if you need to prevent side effects; prefer --dry-run/--stdout options or run with restricted permissions. 4) No external credentials are requested by the skill itself, but test suites or scripts in the repo could be written to read environment variables — avoid running on hosts with sensitive env vars mounted.

Type: OpenClaw Skill Name: nm-abstract-plugin-review Version: 1.8.3 The skill bundle orchestrates a multi-tiered plugin review process by executing shell commands, including 'make' targets and Python scripts located within the repository (e.g., modules/tier-branch.md, modules/tier-release.md). It also invokes several other internal skills (e.g., skills-eval, hooks-eval) and performs git-based diff analysis to determine scope. While these behaviors are aligned with the stated purpose of automated quality assurance, the instructions for the agent to execute arbitrary code and scripts from the workspace represent a high-risk capability that could be exploited if the repository content is untrusted.