Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

PR-Proof-of-Work

v1.0.0

TDD-driven E2E workflow with real Playwright browser screenshots as PR proof. Use when: (1) fix bugs or implement features with test-first approach, (2) crea...

0· 87·0 current·0 all-time
byHaoming Yan@newtontech

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for newtontech/pr-proof-of-work.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "PR-Proof-of-Work" (newtontech/pr-proof-of-work) from ClawHub.
Skill page: https://clawhub.ai/newtontech/pr-proof-of-work
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install pr-proof-of-work

ClawHub CLI

Package manager switcher

npx clawhub@latest install pr-proof-of-work
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with included files: a TypeScript screenshot helper and a shell script that uploads screenshots to a PR. The files and SKILL.md are coherent with a TDD E2E screenshot-to-PR workflow. However, the skill metadata declares no required binaries or env vars while the instructions and script clearly rely on git, the GitHub CLI (gh), and optionally jq/shuf in examples — this mismatch is a notable omission.
Instruction Scope
SKILL.md stays on-task: it instructs creating tests, capturing BEFORE/AFTER screenshots, and making PRs. The provided shell script reads manifest.json, copies image files into the repo, creates a temporary branch, pushes images, and posts a PR comment via gh. All of these actions are within the described purpose and there is no hidden network exfiltration beyond pushing to the user's GitHub repo / using gh.
Install Mechanism
No install spec — instruction-only with two code files. No external downloads or archive extraction are present. This is low risk from an install-execution standpoint.
!
Credentials
The skill omits declaring required environment/binary dependencies: it uses E2E_SCREENSHOT_DIR (SKILL.md tells you to export it) and requires git and gh CLI with push permissions (and in one example uses jq/shuf). The script implicitly depends on an authenticated gh and write access to the repository remote. Those credentials/permissions are not listed in requires.env/primaryEnv, which is an important mismatch — the skill will act with your git/GitHub permissions if run.
Persistence & Privilege
The shell script creates a branch in the repository, copies screenshots into the repo, commits them and does a git push --force to a branch named e2e-screenshots-<PR>. It attempts to restore the user's current branch but performs remote force-pushes and modifies repo state. This behavior is coherent with the 'push screenshots and comment' purpose but is privileged (it mutates the user's repo and remote).
What to consider before installing
This skill is mostly what it says: it helps capture Playwright BEFORE/AFTER screenshots and post them on a PR. Before using it, check these things: (1) the SKILL.md and scripts assume you have git and the GitHub CLI (gh) installed and authenticated with push/comment permissions — the registry metadata did not declare these requirements; (2) the shell script will create a branch, commit screenshots into your repo, and run git push --force on a branch named e2e-screenshots-<PR_NUM> — be sure you are comfortable with that (it can overwrite remote branch history); (3) export E2E_SCREENSHOT_DIR or accept the default path; (4) example commands in the doc sometimes use jq and shuf — ensure those binaries exist if you use the examples; (5) review the scripts (assets/screenshot-reporter.ts and scripts/pr-comment-screenshots.sh) and run them in a safe/test repository or on a fork first to confirm behavior. If you need the skill to avoid modifying your repo, do not run the pr-comment script — instead upload images manually or adapt the script to your policies. If anything here is unclear, ask the maintainer for explicit dependency and permission documentation.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bgw9hqsg7ye9zfsran51kcs847bww
87downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

TDD E2E PR Workflow

One Issue → One PR with visual proof.

Flow: Select one issue → Write test (BEFORE screenshot) → Fix → Test passes (AFTER screenshot) → PR with screenshot comment.

Golden Rule: Study ≥2 existing PASSING tests before writing any new test. Wrong fixture/selector usage is #1 failure cause.


Phase 0: Select One Issue

Choose an open issue to work on, or pick randomly:

# Option A: List and manually select
gh issue list --repo <owner/repo> --state open --json number,title,body

# Option B: Pick one randomly
gh issue list --repo <owner/repo> --state open --json number,title | \
  jq -r '.[] | "\(.number): \(.title)"' | shuf -n 1
  1. Note the issue number and create a short kebab-case slug from title (e.g. "fix-discard-button")
  2. Create isolated worktree:
    git worktree add .worktrees/fix/<slug> -b fix/<slug>
    cd .worktrees/fix/<slug>
    
  3. Copy screenshot-reporter.ts into the worktree's e2e/ directory (not tracked on fix branches)
  4. Set screenshot output:
    export E2E_SCREENSHOT_DIR="$(pwd)/e2e-screenshots"
    

Phase 1: Write Real Browser Test

Step A: Study existing tests (MANDATORY)

Read ≥2 passing E2E tests to understand:

  • Fixture API (withProject, withSession, gotoSession, sdk)
  • Action helpers (waitSessionIdle, runTerminal, openSettings)
  • Selector patterns (data-component, data-slot, ARIA roles)
  • Data seeding (apply_patch, terminal commands, SDK methods)

Step B: Write test with BEFORE screenshot

import { test, expect } from "../fixtures"
import { createScreenshotReporter } from "../screenshot-reporter"

test("feature description", async ({ page, withProject }) => {
  const screenshot = createScreenshotReporter(page, "test-name")

  await withProject(async (project) => {
    // ... setup using project's fixture patterns ...
    await screenshot.captureBefore("initial-state")
    // ... assertions ...
  })
})

Playwright TS transform gotcha — rejects inline object params:

// WRONG: fs.mkdirSync(dir, { recursive: true })
// RIGHT:
const opts = { recursive: true }
fs.mkdirSync(dir, opts)

Apply to ALL object literals: fs.mkdirSync, page.screenshot, page.waitForFunction, etc.


Phase 2: Implement Fix

Write minimum code to pass. Do NOT modify test assertions.

Debugging loop (most tests need 2-4 iterations):

  1. Read error carefully — 90% are selector/fixture mismatches, not logic bugs
  2. Verify DOM — use page.waitForSelector or page.waitForFunction to confirm elements exist
  3. Check prerequisites — hover before clicking, expand before asserting, wait for idle
  4. Use page.pause() to inspect live DOM
  5. Never weaken assertions — fix the code, not the test

Common failure patterns (see references/debugging-guide.md):

SymptomLikely CauseFix
Timeout on selectorWrong data attribute or shadow DOMCheck DOM with page.pause(), try ARIA roles
waitMark never resolvesSeed function missing expected contentMatch seed format exactly from passing tests
Button not visibleMissing hover/expand stepHover parent row, expand section first
Review panel emptyWrong changes mode (git vs session)Switch mode before asserting
Stale element referenceRace condition with async updatesAdd waitSessionIdle after mutations

Phase 3: AFTER Screenshot + Hard Gate

  await expect(fixedElement).toBeVisible()
  await screenshot.captureAfter("feature-working")

Hard gate — ALL three must be true before PR:

  • Test passes (exit code 0)
  • BEFORE-*.png exists
  • AFTER-*.png exists

Phase 4: PR + Screenshot Comment

# Stage, commit, push
git add -A
git commit -m "fix: <issue-description> (closes #<issue-number>)"
git push origin fix/<slug>

# Create PR referencing the issue
gh pr create \
  --title "fix: <short-description>" \
  --body "Closes #<issue-number>

## Summary
<Brief description of the fix>

## Screenshots
| Before | After |
|--------|-------|
| ![Before](<BEFORE-screenshot-url>) | ![After](<AFTER-screenshot-url>) |

## Verification
- [x] E2E test passes
- [x] BEFORE screenshot captured
- [x] AFTER screenshot captured" \
  --repo <owner/repo>

# Push screenshots to branch for GitHub raw URLs
git add e2e-screenshots/
git commit -m "chore: add e2e screenshots"
git push origin fix/<slug>

gh pr comment has no --attach — push images to branch, use raw GitHub URLs.


Backend-Only PRs

For PRs without direct UI changes, find the closest UI-exercisable path:

Change TypeE2E StrategyReal Example
Config utilityOpen settings dialogopenSettings(page) → screenshot config panel
Python resolverRun terminal commandrunTerminal(page, {cmd: "python3 --version"}) → show output
Race conditionTrigger rapid operationsCreate file externally → click refresh → verify
State managementMulti-session switchingSelect file in session A → switch to B → back to A
Cache bypassForce refreshAdd external file → click refresh button → verify
URL parsingCheck connection statusopenStatusPopover(page) → verify connected
Focus managementVerify focus after actionOpen file → check prompt still focused

NEVER use page.setContent() — always test through the real application.


Quick Reference

# Select an issue (manual or random)
gh issue list --repo owner/repo --state open --json number,title

# Create worktree
git worktree add .worktrees/fix/ISSUE -b fix/ISSUE
cd .worktrees/fix/ISSUE

# Set screenshot dir
export E2E_SCREENSHOT_DIR="$(pwd)/e2e-screenshots"

# Run E2E test
npm run test:e2e -- <test-file>

# Push and create PR
git push origin fix/ISSUE
gh pr create --title "fix: ..." --body "Closes #N" --repo owner/repo

Constraints

  • One issue at a time — complete one PR before starting the next
  • BEFORE and AFTER must BOTH exist before PR comment — hard gate, no exceptions
  • Screenshots save to worktree via E2E_SCREENSHOT_DIR, never to main repo
  • Always study ≥2 passing tests first — this is the #1 rule
  • NEVER use page.setContent() — real app only
  • Playwright TS transform rejects inline object params — always extract to variable
  • screenshot-reporter.ts must be copied to each worktree's e2e/ (not on fix branches)
  • Test MUST pass before PR — never create PR with failing tests

Comments

Loading comments...