Double Check
v0.1.0在修改任何文件后(包括删除功能),自动进行两次独立验证(测试/编译/运行检查/文档或配置检查),确保无误才结束。本技能应默认应用于所有文件修改任务。 / After any file changes (including feature removal), automatically perform two in...
⭐ 0· 80·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name and description match the runtime instructions (it is explicitly about running two validations after file edits). However the SKILL.md insists the skill 'should be applied by default to any file modification,' while the registry metadata does not set always:true — a mismatch between the skill's desired default behavior and the platform metadata. This is conceptually important (the skill claims global default application but does not declare the high privilege that would enforce that).
Instruction Scope
The instructions remain within the stated purpose: identify file-change intents, run verification commands (tests/build/run/doc checks), report results, and repeat until two consecutive successes. The doc is prescriptive about commands and reporting and asks to coordinate with the user when no test commands exist. It does require running arbitrary build/test commands which can have side effects (starting services, running network-connected tests), but those actions are consistent with the skill's purpose.
Install Mechanism
No install spec and no code files are present (instruction-only). This is low-risk and consistent with a policy-style skill that tells the agent what to do at runtime.
Credentials
The skill declares no required env vars or binaries, but the instructions assume the presence of many common build/test tools (npm, pytest, cargo, mvn, make, etc.) and the ability to run the project's runtime. That assumption is reasonable for a verification skill, but the skill does not enumerate required tools or explicitly require asking for permission before running commands that might need credentials or external services. This is a proportionality note rather than an outright inconsistency.
Persistence & Privilege
The skill asks (in text) to be applied by default to all file-modification tasks, which implies autonomous invocation. Metadata, however, leaves always:false (so it is not forced platform-wide). Because the platform default allows autonomous invocation of user-invocable skills, the practical effect depends on platform policy. The skill does not request system-wide config changes or other skills' credentials, which is good.
Assessment
This skill is internally coherent: it tells the agent to run two independent verifications after file changes and to report results. Before enabling it broadly, consider the following:
- Clarify default activation: the skill's text wants to auto-apply to every file modification, but the registry flag always:false means the platform won't force that behavior. Decide whether you want it to be applied automatically or only when you explicitly invoke it.
- Confirm available tools: the skill assumes test/build commands (npm, pytest, mvn, cargo, etc.) exist in the execution environment. If your agent runs in a sandbox without those tools, the agent should ask you before attempting validation.
- Be aware of side effects: running the project's main program or tests can start services, hit databases, or call external APIs and may require credentials or cause observable side effects. Prefer running tests in CI or a sandbox, or require explicit user confirmation for risky commands.
- Safety mitigations: require user confirmation before the first execution on a repository, create a VCS checkpoint (commit or branch) before modifications, and prefer non-destructive validation commands where possible. If you are concerned about autonomous execution, keep the skill user-invocable (do not set always:true) or require explicit consent per-run.
If the skill requested platform-wide automatic application (always:true), required unrelated credentials, or included an installer that downloads and executes code, my assessment would be more cautious. As-is, the skill appears coherent with its stated purpose but relies on environmental assumptions that you should validate before use.Like a lobster shell, security has layers — review code before you run it.
latestvk9745p4kvyncn1kp9mn64z3m0d83cdh4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
