Anti-Pattern Czar
v1.0.0Detect and fix TypeScript error handling anti-patterns with state persistence and approval workflows. Use when scanning a codebase for silent error failures,...
⭐ 0· 576·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (detect and fix TypeScript error-handling anti-patterns, with state and approval workflows) matches the SKILL.md workflows: scanning, review, auto-fix, state persistence, and reporting. However, the SKILL.md expects an external runtime command (`bunx antipattern-czar`) but the skill declares no required binaries or install spec — this mismatch is unexpected and should be clarified.
Instruction Scope
Instructions explicitly direct the agent to read project source, parse code contexts, propose and apply edits, and read/write a state file at the project root. Those actions are consistent with the stated purpose (code scanning and in-place fixes). There are no instructions to read unrelated system files, access secrets, or transmit code to external endpoints in the provided content.
Install Mechanism
This is an instruction-only skill (no install spec). Yet SKILL.md tells the agent to run `bunx antipattern-czar`. That implies either (a) a binary/package must already exist in the environment, or (b) bunx will fetch and run code from a registry at runtime. The skill provides no declaration of this dependency or source for `antipattern-czar`, which is an installation/ supply-chain ambiguity and a potential execution-of-untrusted-code risk.
Credentials
The skill requests no environment variables, credentials, or config paths beyond a project-local `.anti-pattern-state.json`. That is proportionate for a code-modifying linter/repair tool. No unrelated secrets or broad system config access is requested.
Persistence & Privilege
The skill persists state to a project-local `.anti-pattern-state.json` and writes edits to source files as part of normal operation. It is not force-installed (always:false). The combination of write-edit capability plus autonomous invocation (platform default) means users should be careful about allowing the skill to run in auto/fix-all modes — the skill can modify repository files, which is intended but potentially impactful if misconfigured.
What to consider before installing
This skill appears to be a coherent code-scanning/fix assistant, but there are a couple of important unknowns you should resolve before installing or running it on important repositories:
- Clarify the `bunx antipattern-czar` dependency. The SKILL.md expects an external command but the skill declares no required binary or install. Ask the author: where does `antipattern-czar` come from (npm package name, GitHub repo, release URL)? Will bunx fetch code at runtime? If so, you are granting the agent the ability to execute remote package code — inspect that package first.
- Prefer Review mode initially. Use the REVIEW mode (interactive, one fix at a time) rather than AUTO, so you can inspect each proposed edit and avoid mass automated changes.
- Backup and limit scope. Run the tool on a branch or a copy of the repo and ensure you have VCS backups before allowing fixes. The skill writes edits and a `.anti-pattern-state.json` file to the project root; be prepared to revert.
- Ask for provenance. The package/source is listed as unknown with no homepage. Lack of origin is a supply-chain risk — request a homepage, source repo, or published package details.
- Check environment readiness. Ensure bun (bunx) is present and that your environment's policy for executing fetched packages is acceptable. If you prefer avoiding network fetches, ask the maintainer for a packaged release or include the detector logic in the skill bundle.
If the author provides a trustworthy source for `antipattern-czar` (e.g., a well-known repository or published package) and documents how bunx will be used, this skill becomes largely coherent and its remaining behaviors are appropriate for its purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk9734kt7hcr8dd82whn48wn2q981evrz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
