Mission Control

What to check before installing: - Review the webhook transform (assets/transforms/github-mission-control.mjs) yourself. It will be copied to ~/.clawdbot/hooks-transforms and will receive GitHub push webhooks. Ensure you trust the code that will be executed on webhook events. - Ensure a webhook secret is configured before enabling the transform. The transform's verifyHmac() will skip HMAC validation when the secret file is absent (it returns true), which would accept unauthenticated webhooks — set up and verify the secret file path in config before exposing the endpoint. - Be aware the transform reads local GH CLI config (~/.config/gh/hosts.yml) to obtain tokens. If you do not want the skill to access your GitHub tokens, do not allow it to be installed or provide an alternative read-restricted token. - The agent will create/modify files under ~/.clawdbot and the workspace, and documentation shows modifying the global hooks mapping. Back up your existing ~/.clawdbot configuration before installation and inspect any changes the agent proposes. - Limit exposure: if possible, test in an isolated environment (throwaway workspace and throwaway GitHub repo) and use scoped tokens. Only provide Slack/GitHub/gateway tokens you are willing to expose to the skill's runtime. - If multiple users can edit the dashboard (multi-user setup), treat all task content as untrusted input and configure agent sandboxing/permissions accordingly. If you want, I can list the exact lines in the transform and scripts that read secrets or change global config and explain mitigation steps for each.