Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Project Bootstrap

v1.0.0

Bootstrap a multi-agent software project from idea to running CI/CD. Use when starting a new project that needs agent team design, task management, GitHub re...

0· 188·0 current·0 all-time
byBingji Guo@ckouder

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ckouder/project-bootstrap.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Project Bootstrap" (ckouder/project-bootstrap) from ClawHub.
Skill page: https://clawhub.ai/ckouder/project-bootstrap
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install project-bootstrap

ClawHub CLI

Package manager switcher

npx clawhub@latest install project-bootstrap
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The skill claims to bootstrap a multi-agent project and includes a taskboard CLI, CI/CD templates, and detailed orchestration instructions — the included files (SKILL.md, CI/CD templates, taskboard script) are coherent with that purpose. However, the SKILL metadata lists no required binaries or env vars even though the instructions and script assume tools (gh, Python) and services (GitHub, Discord).
!
Instruction Scope
Runtime instructions tell the agent to run gh CLI commands, create GitHub rulesets, add repo secrets, and configure Discord webhooks. The SKILL.md and the included script both perform network operations (GitHub API calls, webhook use) and write/read local files (taskboard.json, openclaw.json). These actions are within the skill's scope, but the instructions grant the agent the ability to create repos, set secrets, and post webhooks — high-impact operations that should be explicitly noted and approved by the user or operator.
Install Mechanism
No external install/downloads are performed; this is instruction-heavy and ships a single Python CLI script. No remote code is fetched by an installer during skill installation.
!
Credentials
The registry metadata declares no required environment variables, but the taskboard script expects an optional GITHUB_TOKEN (or custom token env name) and the CI/CD templates/instructions rely on a DISCORD_WEBHOOK secret being created in GitHub. The skill will operate differently depending on those secrets; the omission in the declared requirements is an inconsistency and means the agent or user might be asked to provide or create credentials at runtime without prior notice.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It writes to local files (taskboard.json, cache file) and to repo settings via GitHub API when a token is provided, which are expected behaviors for this functionality.
What to consider before installing
This skill appears to do what it claims (set up agent roles, a local taskboard CLI, GitHub repo and Actions templates, and Discord notifications), but there are important inconsistencies and high-impact steps you should check before installing: - Required tools: The SKILL.md tells you to run gh and the code is a Python CLI. Ensure the host has GitHub CLI (gh) and python3 available; the skill metadata did not list these as required. - Secrets and tokens: The taskboard script will use a GITHUB_TOKEN (or a token env you configure) to sync with GitHub; the CI templates expect a GitHub secret named DISCORD_WEBHOOK for Discord notifications. Only grant the minimum scopes needed (e.g., repo/issues plus workflow and secrets as required) and review who has access to those tokens. - Review code & endpoints: scripts/taskboard.py makes HTTP requests to api.github.com and writes local files (taskboard.json). Inspect the script yourself to confirm endpoints and behavior are acceptable for your environment. - High-impact operations: The workflow includes creating repos, configuring branch protection rules, and adding repo secrets. These can modify org/repo settings — run them with an account that has appropriate permissions and consider testing in a throwaway repo first. - Audit templates: Branch protection JSON and Actions reference specific contexts and status checks (e.g., 'test' status). Verify these match the actual workflows in your repo before applying to main (branch protection with misconfigured checks can block merges). If you want to proceed: run the skill in a controlled/test repository or sandbox, provide least-privilege tokens, and verify/disallow any automated agent actions that create or modify GitHub org-level resources without explicit human approval.

Like a lobster shell, security has layers — review code before you run it.

latestvk978nq3rasyhp3vhwx5fsm323n836czg
188downloads
0stars
1versions
Updated 8h ago
v1.0.0
MIT-0

Project Bootstrap

Turn a project idea into a running multi-agent development pipeline in one session.

Overview

This skill codifies the workflow for:

  1. Agent Team Design — break complex work into specialized agents
  2. Taskboard Setup — CLI-based task management across agents
  3. GitHub Repo + CI/CD — TDD pipeline with Discord notifications

Phase 1: Agent Team Design

Analyze the Project

Before creating agents, answer these questions:

  • What are the 3-5 major workstreams? (e.g., frontend, backend, research, design)
  • Which workstreams need different expertise or thinking styles?
  • What's the dependency graph between workstreams?

Design Agent Roles

For each workstream, create an agent with a SOUL.md following this structure:

# Agent Name — Nickname Emoji

You are **Nickname**, the [Role] — [one-line mission].

## 🧠 Identity & Memory
- **Role**: [specific expertise]
- **Personality**: [3-4 traits that affect work style]
- **Memory**: [what context files they track]
- **Experience**: [what failure modes they've seen]

## 🎯 Core Mission
[2-4 responsibility groups with specifics]

## 🚨 Critical Rules
[Non-negotiable constraints — security, process, boundaries]

## 📋 Deliverables
[Concrete outputs this agent produces]

## 🎯 Success Metrics
[How to measure if the agent is doing well]

## 💬 Communication Style
[How the agent communicates — tone, format, language]

## 🔗 Workflow Position
[Where in the pipeline: who feeds input, who receives output]

Register Agents in Config

For each agent, add to openclaw.json:

{
  "id": "agent-id",
  "name": "agent-id",
  "agentDir": "/path/to/workspace/agents/agent-id",
  "model": "model-alias",
  "tools": {
    "profile": "full",
    "deny": ["gateway"]
  }
}

Key decisions:

  • Model selection: Use cheaper models (Haiku/Sonnet) for routine work, expensive (Opus) for architecture/review
  • Tool access: Deny gateway for all agents except main. Deny message for pure code agents.
  • Subagent allowlist: Main agent lists which agents it can spawn

Wire Discord Bindings (if multi-bot)

If agents have separate Discord bots, add bindings:

{
  "bindings": [
    { "agentId": "tech-lead", "match": { "channel": "discord", "accountId": "bot-name" } }
  ]
}

Phase 2: Taskboard Setup

Install Taskboard CLI

See references/taskboard-setup.md for the full taskboard CLI setup guide including:

  • Task schema (id, title, status, assignee, priority, dependencies)
  • CLI commands (create, list, assign, update, close)
  • Cross-agent task handoff protocol
  • Integration with cron jobs for status checks

Task Lifecycle

📋 backlog → 🔄 in-progress → 👀 review → ✅ done
                ↓                  ↓
              🚫 blocked        ❌ rejected → 🔄 in-progress

Cross-Agent Handoff

When an agent completes a task that feeds into another agent's work:

  1. Update task status to review
  2. Create a new task for the downstream agent referencing the completed task
  3. Send notification to the downstream agent's Discord channel

Phase 3: GitHub Repo + CI/CD

Repository Setup

# Initialize repo
gh repo create <org>/<project> --private --clone
cd <project>

# Branch protection
gh api repos/<org>/<project>/rulesets -X POST --input .github/ruleset.json

# Required structure
mkdir -p .github/workflows tests src docs/adr

TDD Pipeline

See references/ci-cd-templates.md for GitHub Actions workflow templates:

  • test.yml: Run tests on every PR and push to main
  • lint.yml: Code style checks
  • deploy.yml: Deploy on merge to main (if applicable)

Discord Notifications

Add Discord webhook to GitHub repo:

# Create webhook in Discord channel (Server Settings → Integrations → Webhooks)
# Add to GitHub: Settings → Webhooks → Add webhook
# Or use GitHub Actions:

See references/ci-cd-templates.md for the Discord notification action template.

ADR (Architecture Decision Records)

Every significant technical decision gets an ADR:

# ADR-NNN: [Title]

## Status: [proposed | accepted | deprecated | superseded]
## Context: [Why this decision is needed]
## Decision: [What we decided]
## Consequences: [Trade-offs and implications]

Execution Checklist

Run through this for every new project:

  • Define project scope and 3-5 workstreams
  • Design agent SOUL.md for each workstream
  • Register agents in openclaw.json
  • Set up Discord channels per agent/workstream
  • Create GitHub repo with branch protection
  • Add CI/CD workflows (test + lint + deploy)
  • Add Discord webhook for CI/CD notifications
  • Initialize taskboard with backlog items
  • Create first ADR (ADR-001: Project Architecture)
  • Assign initial tasks to agents
  • Run a test cycle: create task → agent executes → review → merge

Comments

Loading comments...