Openclaw Skill Clawban

This skill appears to be a genuine CLI-first Kanban integrator, but there are a few mismatches and practical risks to consider before installing: - Metadata vs reality: The registry metadata claims no required binaries or env vars and no install step, but the repository and SKILL.md require Node/npm (npm ci) and adapter CLIs (gh, planka-cli, plane, curl, jq). Expect to run npm ci and to install adapter CLIs yourself. - Credentials: If you enable the Plane or Linear adapters you will need PLANE_API_KEY/PLANE_WORKSPACE or LINEAR_API_KEY. The linear wrapper script (scripts/linear_json.sh) sends LINEAR_API_KEY in an Authorization header to api.linear.app — review that script and only provide API keys you trust and scope to least privilege. - Privilege inheritance: The skill shells out to platform CLIs and acts with the same permissions those CLIs or API keys have. Ensure CLI sessions and tokens are scoped appropriately (least privilege) before using the skill. - Cron/install behavior: The skill can optionally install an autopilot cron job. If you use that option, verify what it writes (the cron entry and command) and ensure it runs in an environment with only the credentials you intend. - Review scripts and code: The included scripts (linear_json.sh, planka_whoami_json.mjs) and TypeScript files are readable; scan them to confirm there are no unexpected network destinations or obfuscated logic. There are no scanner flags in the provided data, but the metadata inconsistencies above warrant manual review. Recommended actions: review the two wrapper scripts and package.json, run npm ci in an isolated environment if you plan to execute locally, provide adapter API keys only when necessary and with least privilege, and avoid using the autopilot cron install until you have inspected what it will create.