Code Reviewer

What to check before installing: - Ask the publisher to explain the auth model: does this use a GitHub App, an OAuth token, or personal access tokens? Request a minimal-scoped GitHub App option and explicit list of required scopes (read-only for comments; write/merge only if strictly necessary). - Resolve the binary/CLI mismatch: SKILL.md examples use 'clawhub', but metadata lists 'openclaw' and 'github'—confirm the actual CLI and its provenance before running it. - Require explicit install steps and a signed release or well-known distribution channel (not an unverified binary you must download manually). - Don’t grant admin/merge rights until you can audit the code or run the skill in a restricted, test repo. Prefer provisioning a service account with least privilege and audit logs. - Verify how the skill stores and protects repository tokens (where on disk, file permissions, rotation policy). - If you need this capability but don’t trust the vendor yet, run the skill in read-only mode (comments only) on a sandbox repo and monitor actions. If the publisher provides clear, coherent install docs that declare the exact credentials and minimum required scopes (or a GitHub App with install tokens), and fixes the CLI/binary inconsistencies, this assessment could change to benign.