Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
PR-Proof-of-Work
v1.0.0TDD-driven E2E workflow with real Playwright browser screenshots as PR proof. Use when: (1) fix bugs or implement features with test-first approach, (2) crea...
⭐ 0· 25·0 current·0 all-time
byHaoming Yan@newtontech
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with included files: a TypeScript screenshot helper and a shell script that uploads screenshots to a PR. The files and SKILL.md are coherent with a TDD E2E screenshot-to-PR workflow. However, the skill metadata declares no required binaries or env vars while the instructions and script clearly rely on git, the GitHub CLI (gh), and optionally jq/shuf in examples — this mismatch is a notable omission.
Instruction Scope
SKILL.md stays on-task: it instructs creating tests, capturing BEFORE/AFTER screenshots, and making PRs. The provided shell script reads manifest.json, copies image files into the repo, creates a temporary branch, pushes images, and posts a PR comment via gh. All of these actions are within the described purpose and there is no hidden network exfiltration beyond pushing to the user's GitHub repo / using gh.
Install Mechanism
No install spec — instruction-only with two code files. No external downloads or archive extraction are present. This is low risk from an install-execution standpoint.
Credentials
The skill omits declaring required environment/binary dependencies: it uses E2E_SCREENSHOT_DIR (SKILL.md tells you to export it) and requires git and gh CLI with push permissions (and in one example uses jq/shuf). The script implicitly depends on an authenticated gh and write access to the repository remote. Those credentials/permissions are not listed in requires.env/primaryEnv, which is an important mismatch — the skill will act with your git/GitHub permissions if run.
Persistence & Privilege
The shell script creates a branch in the repository, copies screenshots into the repo, commits them and does a git push --force to a branch named e2e-screenshots-<PR>. It attempts to restore the user's current branch but performs remote force-pushes and modifies repo state. This behavior is coherent with the 'push screenshots and comment' purpose but is privileged (it mutates the user's repo and remote).
What to consider before installing
This skill is mostly what it says: it helps capture Playwright BEFORE/AFTER screenshots and post them on a PR. Before using it, check these things: (1) the SKILL.md and scripts assume you have git and the GitHub CLI (gh) installed and authenticated with push/comment permissions — the registry metadata did not declare these requirements; (2) the shell script will create a branch, commit screenshots into your repo, and run git push --force on a branch named e2e-screenshots-<PR_NUM> — be sure you are comfortable with that (it can overwrite remote branch history); (3) export E2E_SCREENSHOT_DIR or accept the default path; (4) example commands in the doc sometimes use jq and shuf — ensure those binaries exist if you use the examples; (5) review the scripts (assets/screenshot-reporter.ts and scripts/pr-comment-screenshots.sh) and run them in a safe/test repository or on a fork first to confirm behavior. If you need the skill to avoid modifying your repo, do not run the pr-comment script — instead upload images manually or adapt the script to your policies. If anything here is unclear, ask the maintainer for explicit dependency and permission documentation.Like a lobster shell, security has layers — review code before you run it.
latestvk97bgw9hqsg7ye9zfsran51kcs847bww
License
MIT-0
Free to use, modify, and redistribute. No attribution required.