Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Workspace Project Standard
v1.0.1Project workspace setup and documentation standard for OpenClaw agents. Enforces a three-layer documentation system and self-contained project structure. Tri...
⭐ 0· 421·1 current·1 all-time
by@lnshyo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name and description (project workspace & documentation standard) match the SKILL.md content: templates, directory rules, and update triggers all align with a documentation/workspace policy. The skill requests no binaries, env vars, or installs, which is proportionate for a purely procedural standard.
Instruction Scope
The runtime instructions tell the agent to run a scaffold script (scripts/new-project.ps1) and to create/move/modify files in the workspace root (AGENTS.md, MEMORY.md, CREDENTIALS.md, projects/*). Editing global workspace files and maintaining credential references are within scope for a workspace standard but expand the agent's write scope to system-level documents — this is notable because it can affect other workflows and may surface or restructure sensitive information.
Install Mechanism
No install spec and no code files beyond templates; nothing is written to disk by an installer. This is the lowest-risk install footprint (instruction-only).
Credentials
The skill declares no required environment variables or credentials, which is appropriate. However, templates and LINKs.md explicitly reference a CREDENTIALS.md and suggest '凭据引用' (credential references). The skill does not request secrets itself but instructs agents to document and reference credentials — review how your environment stores/limits access to CREDENTIALS.md and avoid putting raw secrets into documentation files.
Persistence & Privilege
always is false (good) and autonomous invocation is allowed (normal). The main persistence/privilege concern is that the instructions modify shared workspace root files (AGENTS.md, MEMORY.md, CREDENTIALS.md) and enforce moving files between root and project directories; this grants the skill effective write influence over global workspace state and should be constrained by agent permissions and review policies.
Assessment
This skill is a documentation/workspace policy and appears coherent, but it instructs agents to edit global workspace files and to reference credentials. Before installing: (1) review and trust any scripts it will run (scripts/new-project.ps1) — the skill will run that if present; (2) back up AGENTS.md, MEMORY.md, and CREDENTIALS.md and confirm they do not contain raw secrets you don't want agents to modify; (3) restrict the agent's file-write permissions to only the intended workspace directories if possible; (4) enforce a policy that credentials are stored only in secure secret stores (not in plain CREDENTIALS.md or LINKS.md); and (5) test the scaffold flow in an isolated environment first. If you need help checking scripts/new-project.ps1 or locking down CREDENTIALS.md handling, review those files before enabling autonomous runs.Like a lobster shell, security has layers — review code before you run it.
latestvk97a6adfaqybmp1e8kt7xzvqq581yj6s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.