IGA Pages
v1.0.3Develop and deploy projects on IGA Pages — CLI workflow (login, link, dev, build, deploy), serverless functions (api/ routes), and build config. Use when the...
⭐ 0· 138·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The SKILL.md documents CLI workflows, project linking, and use of Volcengine AK/SK — all consistent with a deployment CLI. The skill metadata lists no required env vars or credentials, but the runtime instructions clearly rely on Volcengine credentials (~/.iga/auth.json or env vars/flags). This mismatch (instructions expect credentials but metadata declares none) is notable but explainable for an instruction-only skill.
Instruction Scope
Instructions stay within the scope of building, local dev, linking, and deploying projects. They explicitly reference project-local files (.iga/project.json) and user credentials (~/.iga/auth.json) which are necessary for the stated tasks. There are no instructions to read unrelated system files, exfiltrate data, or POST to unexpected endpoints.
Install Mechanism
This is an instruction-only skill (no install spec). The docs advise installing the CLI via npm (npm i -g @iga-pages/cli), which is expected for this use case. Because there is no bundled install spec, the skill itself writes nothing to disk, but users will download a third-party npm package if they follow the guide — verify the package before installing.
Credentials
The CLI requires Volcengine AK/SK to authenticate and deploy; that is proportionate to deploying to IGA Pages. However, the skill metadata does not declare these credentials as required env vars or a primary credential — the runtime docs instead describe flags, env vars, or ~/.iga/auth.json. The number and scope of credentials requested is reasonable for a deploy tool.
Persistence & Privilege
The skill does not request 'always: true' and has no install-time persistence. Runtime behavior (the CLI writing ~/.iga/auth.json and .iga/project.json) is normal and limited to the user's environment and project; the skill does not instruct modification of other skills or global agent settings.
Assessment
This skill is internally consistent: it documents using the @iga-pages/cli to login, link, build, and deploy and requires Volcengine AK/SK at runtime. Before installing or running the CLI: 1) verify the npm package name and publisher (inspect the package contents or GitHub repo) to ensure you trust it; 2) avoid storing long-lived root credentials on shared machines — use least-privilege or short-lived keys if possible; 3) expect the CLI to create ~/.iga/auth.json and .iga/project.json and to append .iga/ to .gitignore; do not commit those files; 4) when running non-interactively, pay attention to the CLI's non‑TTY behavior (it may exit or require --yes); and 5) if you need stronger assurance, test in an isolated environment or inspect the published CLI source before granting it credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk979dkdey5m6dv29wz0kr5x8rx83zsjz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.