Code Quality System (FightingDao)

This package is functionally coherent with a code-quality system, but there are important red flags you should address before installing or running it: - Metadata mismatch: The registry claims no env vars/configs but the code expects several files and secrets (openclaw.json with AI apiKey, DB credentials for Prisma or DATABASE_URL, SMTP credentials, Teams webhook/secret). Treat that as a serious discrepancy — assume the skill will read those files from your HOME. - Sensitive data flows: The scripts gather git diffs, commit metadata, and file contents and send them to an external AI provider (configured in ~/.openclaw/openclaw.json) and to Teams/SMTP. If your repositories contain proprietary or secret data, this will transmit it to third-party endpoints. Only proceed if the AI provider and notification endpoints are trusted or you run the AI locally. - Fabricated data: The system enforces generating at least one code issue per project if none are found. That can insert artificial records into your database and produce misleading reports; review/adjust this behavior if you need accurate audits. - Recommended precautions: 1) Do not run on a production machine or a host containing sensitive repos. Use an isolated VM/container with limited network access. 2) Inspect and vet the config files (README references GitHub repo URLs and config.json). Confirm the GitHub URLs are legitimate and review the cloned repos before running their install scripts. 3) Provide least-privilege credentials: create a dedicated DB user with limited rights and an email account/bot that only sends to intended recipients. Prefer SQLite if acceptable to avoid exposing DB credentials. 4) If you must use an AI provider, prefer one you control or an on-prem/local model; otherwise restrict network access and monitor traffic. Check ~/.openclaw/openclaw.json contents and confirm the provider is trusted. 5) Review and test scripts (especially those using child_process/execSync) to ensure they do what you expect. Consider running with dry-run flags or adding logging before allowing any write (DB insert/delete) operations. 6) If you want to use the skill only for local analysis without exfiltration, modify AI calls to a local model or disable notify scripts and external POSTs. Given the metadata omissions and external data flows, treat this skill as suspicious until you validate its config and endpoints, and run it in a sandboxed environment.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.