ostree
v1.0.0Manage OSTree atomic system updates with repository, commit, deployment, branch, remote sync, and RPM-OSTree integration for immutable system infrastructures.
⭐ 0· 76·1 current·1 all-time
bywei dong@weidongkl
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (OSTree atomic updates) match the SKILL.md content and package.json metadata. The skill instructs how to install ostree/rpm-ostree, initialize repos, manage commits, deployments, branches, remotes, and compose images — all appropriate for the stated purpose.
Instruction Scope
The SKILL.md contains many system-level commands (ostree, rpm-ostree, journalctl) and file paths (/ostree/repo, /var/www/html, /path/to/repo). These are expected for OSTree operations but will require root privileges and can modify system state. The doc references fetching from ostree.fedoraproject.org and an example URL (example.com) — the latter is a placeholder; avoid using untrusted external RPM URLs.
Install Mechanism
No install spec is bundled; the instructions recommend using the distribution package manager (dnf/apt/zypper) to install ostree/rpm-ostree. This is standard and low risk compared to arbitrary downloads or embedded installers.
Credentials
The skill declares no required environment variables, credentials, or config paths. The SKILL.md does not instruct reading unrelated secrets or environment variables beyond typical file paths and GPG keys used for signing/verification.
Persistence & Privilege
always is false and there is no install script bundling persistent agents or modifying other skills. The skill can be invoked by the agent (default) but it does not request elevated platform privileges beyond normal LLM-plugin behavior.
Assessment
This skill is coherent with OSTree usage, but be aware it runs system-level commands that require root and can change your OS. Before using: (1) run it only on machines where you expect to perform OSTree/rpm-ostree operations; (2) inspect any remote URLs or RPMs before pulling/installing (do not install from untrusted hosts); (3) ensure you trust any GPG keys you import for signing/verification; (4) if you do not want the agent to run these commands autonomously, disable autonomous invocation when installing the skill.Like a lobster shell, security has layers — review code before you run it.
atomicvk97745eax7ts4g3cn1vsq8wsds83eg13coreosvk97745eax7ts4g3cn1vsq8wsds83eg13fedoravk97745eax7ts4g3cn1vsq8wsds83eg13immutablevk97745eax7ts4g3cn1vsq8wsds83eg13latestvk97745eax7ts4g3cn1vsq8wsds83eg13ostreevk97745eax7ts4g3cn1vsq8wsds83eg13
License
MIT-0
Free to use, modify, and redistribute. No attribution required.