Auto Dev Pipeline
Analysis
This is a disclosed instruction-only automation pipeline that chains other development skills and writes local project outputs, with no malicious behavior evident, but users should verify the referenced sub-skills before relying on the hands-off workflow.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
The pipeline uses OpenClaw's session management to automatically: 1. Spawn `prd-skill` sub-agent ... 2. Monitor PRD completion and trigger `dev-skill` ... 3. Monitor code generation and trigger `qa-skill`
The artifact clearly instructs a chained, automatic multi-agent workflow. This is central to the skill's stated purpose, but it means one user request can initiate multiple actions and generated outputs.
This skill coordinates prd-skill, dev-skill, and qa-skill
The main workflow depends on other named skills, but the reviewed package has no install spec or dependency/version declarations for them.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
User Input → prd-skill → PRD Document → dev-skill → SwiftUI Project → qa-skill → Test Suite
The artifact documents passing user requirements, generated PRDs, and generated code between multiple sub-agents. This is expected for the pipeline, but data boundaries and trust assumptions for those agents are not detailed.