ClawCompany

What to check before installing: - Clarify the metadata: the registry says no required env vars but the skill and README require GLM_API_KEY — ask the publisher or inspect the source to confirm required environment variables. - Limit the GLM API key: if you provide one, use a scoped or low-privilege key and rotate it if used for testing. - Run in dry-run and/or a disposable directory first: set DRY_RUN=true and PROJECT_ROOT to an empty test folder to avoid exposing real project files; the spawned agents are given cwd/projectPath and could access files under that directory. - Inspect prompts and agent tasks: SKILL.md contains system prompts and 'return only JSON' directives — review them to ensure there are no instructions that would leak secrets or override safety policies. - Prefer installing from a verified source: README references a GitHub repo and ClawHub; confirm publisher identity and check the repository history for tampering. - If you rely on this skill in production, request the maintainer add declared requires.env metadata (GLM_API_KEY, PROJECT_ROOT) so installs properly inform users. If you want, I can produce a concise checklist / commands to safely test this skill (dry-run, sandboxed directory, which files to inspect in the repo).