OpenClaw Coding Agent Workflows

This skill is coherent with its goal of orchestrating other coding agents, but there are actionable concerns you should consider before using it: - Missing local dependencies: Examples call git, gh, mktemp, and bash behaviors not declared in the metadata. Ensure those CLIs exist and are the versions you expect. - Permission bypass: The advice to run Claude Code with '--permission-mode bypassPermissions' effectively disables safety controls. Avoid that flag unless you fully trust the agent binary and isolate its execution environment. - Full-auto + PTY risk: Running agent binaries with PTY:true and --full-auto lets the remote agent execute arbitrary commands inside your repository. Use temp clones or worktrees (as the guide suggests), scan outputs, and never run this on sensitive repos or your real OpenClaw config (~/.openclaw). - Credential handling: The skill does not request credentials, but the agent CLIs likely need API keys or gh auth. Verify where those credentials are stored and limit their scope (least privilege). Prefer ephemeral tokens and sandboxed environments. - Audit and gating: Add review gates (manual approval before merges), run tests in sandboxed CI, and consider restricting network or filesystem access for agent runs. Given the permission-bypass recommendation and the omission of other required tools, treat this skill as high-risk and only run it in isolated, disposable environments until you validate its behavior and configuration.