Preqstation
ReviewAudited by ClawScan on May 10, 2026.
Overview
This is mostly a coherent coding-agent launcher, but it can run local coding CLIs with sandbox-disabling flags and long-running sessions, so it should be reviewed before use.
Install only if you are comfortable letting OpenClaw launch local coding agents against your repositories. Before use, confirm the exact project mapping, prefer sandboxed CLI modes, require approval before any dangerous or no-sandbox flag, and monitor/stop background sessions.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A coding agent could modify files or run project commands with fewer safety checks than the user expects.
This tells the agent it may use flags that disable sandbox or approval protections when launching local coding agents. The behavior is related to the skill purpose, but it is high-impact and not gated by explicit user approval in the provided text.
Use `dangerously-*` / sandbox-disable flags only for actual coding execution with local trusted CLIs.
Require explicit user confirmation before using any sandbox-disabling or dangerous flag, and prefer sandboxed/default CLI modes unless the user knowingly opts out.
Separate coding tasks may accidentally edit the same workspace or branch, making it harder to review, revert, or isolate changes.
The text calls this a per-task worktree, but the shown path and branch are keyed only by project. Multiple tasks for the same project could share the same branch/worktree, causing changes or running sessions to interfere with each other.
directory: `<worktree_root>/<project_key>` ... `git -C <project_cwd> worktree add -b codex/<project_key> <cwd> HEAD`
Use a unique task ID or timestamp in every worktree path and branch name, and avoid launching a new task if another session is already active in the same worktree.
Local project paths will be saved in the skill’s memory file and reused in later tasks.
The skill persists local workspace path mappings for later reuse. This is purpose-aligned, but stored paths can reveal project locations and an incorrect mapping could redirect future coding work.
This skill reads and updates `MEMORY.md` project mappings with absolute paths.
Review `MEMORY.md` periodically, keep only intended project paths, and confirm mappings before running coding agents.
A coding task may keep running in the background and continue changing files until monitored or stopped.
The skill supports long-running background CLI sessions. This is disclosed and related to coding-agent execution, but users should be aware that work may continue after the initial response.
use `background:true` only when asynchronous execution is needed ... monitor background sessions with `process action:poll` and `process action:log`
Check active sessions, review logs, and stop background tasks when they are no longer needed.