Security audit
Security checks across malware telemetry and agentic risk
The skill is a real SDLC automation framework, but it gives agents broad code, Git, deployment, external-sync, hook, and service-restart authority that is not fully bounded or disclosed in the main skill instructions.
Install only if you are comfortable giving this skill authority to spawn agents, edit and commit code, create and delete branches, merge reviewed changes, write run artifacts, send OpenClaw messages, and perform deployment actions. Before use, review deploy.sh, kit-deploy.sh, orchestrator.py, and config/prompts.json; disable or remove GitHub auto-sync, git hook installation, and gateway restart behavior if you do not explicitly want them. Run it only in repositories you control, with trusted environment variables and CLI arguments.
print(f"[{role or 'system'}] Invoking agent driver: {' '.join(cmd)}")
for attempt in range(3):
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode == 0:
print(result.stdout)
if return_output:diff_file = os.path.join(args.run_dir, "current_arbitration.diff")
diff_cmd = f"git diff {args.diff_target} --no-color > {diff_file}"
subprocess.run(diff_cmd, shell=True)
task_string = build_prompt("arbitrator",
workdir=workdir,if not args.override_diff_file:
diff_cmd = f"git diff {args.diff_target} --no-color > {diff_file}"
subprocess.run(diff_cmd, shell=True)
baseline_file = os.path.join(args.run_dir, "baseline_commit.txt")
if os.path.exists(baseline_file):else:
history_depth = max(5, pr_num)
history_cmd = f"git log -n {history_depth} -p {args.diff_target} > {os.path.join(args.run_dir, 'recent_history.diff')}"
subprocess.run(history_cmd, shell=True)
guardrail_violation = check_guardrails(workdir, pr_content, [os.path.join(workdir, diff_file)])
if guardrail_violation:# Run orchestrator cleanup
orchestrator_path = "/root/.openclaw/workspace/projects/leio-sdlc/scripts/orchestrator.py"
res = subprocess.run([
"python3", orchestrator_path,
"--workdir", td,
"--prd-file", "dummy.md",fcntl.flock(f, fcntl.LOCK_EX | fcntl.LOCK_NB)
orchestrator_path = "/root/.openclaw/workspace/projects/leio-sdlc/scripts/orchestrator.py"
res = subprocess.run([
"python3", orchestrator_path,
"--workdir", td,
"--prd-file", "dummy.md",print(f"[{role or 'system'}] Invoking agent driver: {' '.join(cmd)}")
for attempt in range(3):
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode == 0:
print(result.stdout)
if return_output:if test_mode:
run_dir = os.environ.get("SDLC_RUN_DIR", ".")
os.makedirs(os.path.join(run_dir, "tests"), exist_ok=True)
with open(os.path.join(run_dir, "tests", "auditor_task_string.log"), "w") as f:
f.write(task_string)
if "REJECT" in os.environ.get("MOCK_AUDIT_RESULT", ""):
output = '{"status": "REJECTED", "comments": "Mock rejected"}'import json
run_dir = os.environ.get("SDLC_RUN_DIR", ".")
os.makedirs(os.path.join(run_dir, "tests"), exist_ok=True)
with open(os.path.join(run_dir, "tests", "verifier_task_string.log"), "w") as f:
f.write(task_string)
mock_result = os.environ.get("MOCK_VERIFIER_RESULT", '{"status": "PASS", "executive_summary": "Mock passed", "verification_details": []}')54/54 vendors flagged this skill as clean.
Detected: suspicious.prompt_injection_instructions