Dark Factory Skill

Manage multiple SaaS startups simultaneously with CEO-driven orchestration, product agents, ChatDev code generation, and a 3-Gate BUILD, TEST, JUDGE pipeline.

Security Scan

The skill's runtime instructions expect external credentials, remote installs, and workspace repos that are not declared in the registry metadata and would cause arbitrary code to be fetched/executed — the pieces don't align and warrant caution.

Purpose & Capability

The SKILL.md describes a complex multi-agent 'factory' that requires an Anthropic (Claude) API key, ChatDev cloning, product repos, and a setup script, but the registry metadata lists no required env vars, no config paths, and no install spec. Requiring a Claude API key and multiple product repositories is consistent with the described purpose, but those requirements are missing from the declared metadata — an incoherence.

Instruction Scope

Runtime instructions tell the agent/user to run 'npx clawhub@latest install dark-factory', execute 'bash scripts/setup-dark-factory-v2.sh', and auto-clone github.com/OpenBMB/ChatDev. Those steps will fetch and run remote code and expect workspace product repos and real data/screenshots. The SKILL.md grants broad operational scope (build/test/judge loops, scheduled retrospectives) without limiting what files or secrets may be accessed during setup or execution.

Install Mechanism

There is no formal install spec in the registry, but SKILL.md instructs use of npx (which downloads and executes code from npm) and cloning a GitHub repository. That implies running arbitrary third-party code during setup; because the registry does not vet or declare these artifacts, the install mechanism is higher risk and opaque.

Credentials

The instructions explicitly require a Claude API key and product repositories, but the skill metadata declares no required env vars or primary credential. This mismatch is problematic: the skill will likely need credentials and repo access to function, yet none are declared for review. The SKILL.md's instruction to use 'real data' for testing also raises potential data exposure concerns.

Persistence & Privilege

always is false (good) and autonomous invocation is allowed (platform default). The skill describes scheduled/continuous processes (weekly retrospectives, L6 engine) which imply persistent activity, but no explicit 'always' privilege is requested. This combination is noteworthy but not by itself a high privilege escalation.

What to consider before installing

This skill's description and its runtime instructions don't match the registry metadata. Before installing: 1) ask the publisher for a complete install spec and an explicit list of required environment variables (e.g., Claude API key) and repository access needs; 2) inspect the actual scripts that 'npx clawhub' and 'scripts/setup-dark-factory-v2.sh' would run — don't run remote install commands without reviewing them; 3) avoid using sensitive production data during initial setup/testing and use dedicated test accounts; 4) prefer an implementation that declares its required credentials and provides reproducible, auditable install artifacts (tagged GitHub releases or a registry-stored package) rather than opaque npx/git cloning. If the publisher cannot provide clear, reviewable code and declared credentials, treat this skill as risky and consider not installing it.

Dark Factory Multi-Agent Startup Platform

Run multiple SaaS startups in parallel using specialized OpenClaw agents, a CEO orchestrator, and ChatDev-powered code generation. Based on Chris Benson's L4.1 Dark Factory architecture.

What This Skill Installs

A complete multi-agent startup operating system with:

• CEO/orchestrator agent that routes work across product agents
• Per-product agents (pre-configured for VerdictLegal, Surfaced, SayfeAI, CashPing)
• 3-Gate Pipeline enforcement: BUILD -> TEST -> JUDGE
• L6 continuous improvement engine
• ChatDev integration for multi-agent code generation

Architecture (The Factory Floor Analogy)

Think of this like a real startup factory:

• The CEO agent is the plant manager — decides what gets built and when
• Product agents are specialized assembly lines — each knows its product deeply
• ChatDev is the robotic assembly arm — multi-agent code generation
• The 3-Gate Pipeline is quality control — nothing ships without passing all 3 gates

Usage

After installing, configure your products in DARK_FACTORY.md:

1. Run CEO agent for strategic prioritization
2. CEO routes spec to the right product agent
3. Product agent runs ChatDev for BUILD gate
4. Independent TEST gate validates against spec scenarios
5. JUDGE gate scores 8 dimensions — SHIP if avg >= 4.0

3-Gate Pipeline

Gate 1: BUILD — Implements from spec. Uses SDD scenarios as acceptance criteria. Gate 2: TEST — Independent QA validates. Real data. Screenshots as evidence. Grades A-F.
Gate 3: JUDGE — Sees spec + test results only (never code). 8 dimensions. SHIP or ITERATE.

Decision Hierarchy

Strategy > Specifications > Validation > Selling > Building > Debugging

If your agent is debugging instead of strategizing, this skill will push it back up.

L6 Self-Improvement Engine

Four feedback loops that make the factory smarter every day:

1. Weekly Retrospective (Sundays 9PM)
2. Post-Build Learning (every ITERATE/REJECT logs root cause)
3. Competitive Reprioritization (daily intel updates build queue)
4. Tester → Builder Direct Feedback (closes the knowledge gap)

Requirements

• OpenClaw with multiple agent support
• Claude API key (Anthropic)
• ChatDev (auto-cloned on setup): github.com/OpenBMB/ChatDev
• Product repositories configured in workspace

Setup

1. Install this skill: npx clawhub@latest install dark-factory
2. Configure DARK_FACTORY.md with your products
3. Run setup script: bash scripts/setup-dark-factory-v2.sh
4. Launch CEO agent and describe your product portfolio

License

MIT