Repo Kanban PM

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears purpose-aligned, but it can modify repo workflow files and optionally create a recurring OpenClaw PM review.

This skill is reasonable for adding a kanban-style PM workflow to a repo. Before using it, confirm the target path is correct, review the changes to docs and AGENTS.md, and only enable the daily cron if you want an ongoing automated agent review that may use GitHub CLI context and run a lightweight type-check command.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the script will change files in the target repo, including future-agent instructions.

Why it was flagged

The initialization script creates PM workflow files and appends a section to AGENTS.md in the selected repository.

Skill content
mkdir -p docs/pm docs/pm/bugs ... cat >> AGENTS.md <<'EOF'
Recommendation

Run it only against the intended repository and review the resulting git diff before committing.

What this means

Future agents working in the repo may be steered by these mandatory kanban rules.

Why it was flagged

The script persists workflow instructions in AGENTS.md, which future agents may treat as authoritative repo context.

Skill content
## Feature Execution Workflow (Kanban, Mandatory)
Recommendation

Review the AGENTS.md addition and remove or edit it if it does not match your team workflow.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If installed, an agent will run a PM review on the repo every day until the cron is removed.

Why it was flagged

The optional script creates a recurring OpenClaw cron task for daily PM review.

Skill content
openclaw cron add --name "${NAME}" --agent "${AGENT_ID}" --cron "${CRON_EXPR}" ... --message "Run daily PM review for repo: ${REPO_PATH}"
Recommendation

Use the cron only if you want ongoing automated review, and know how to list or remove the OpenClaw cron later.

What this means

The review may query GitHub repository metadata using whichever account the local gh CLI is authenticated as.

Why it was flagged

The scheduled review prompt may cause the agent to use the local GitHub CLI account/session to inspect PRs.

Skill content
4) gh pr list + check recent commits
Recommendation

Ensure gh is logged into the intended account and repository before enabling the cron.

What this means

A scheduled agent may execute a repo-local Node/TypeScript check, which could be inappropriate for non-Node repos or unexpected in a daily PM audit.

Why it was flagged

The optional daily review instructions include running project tooling through npx when applicable.

Skill content
6) Run lightweight checks (if applicable): cd apps/telegram && npx tsc --noEmit
Recommendation

Edit or avoid the cron message if you do not want automated project commands run during PM review.