Quality Gates
v0.1.0Quality checkpoints at every development stage — pre-commit through post-deploy — with configuration examples, threshold tables, bypass protocols, and CI/CD integration. Use when setting up quality automation, configuring CI pipelines, establishing coverage thresholds, or defining deployment requirements.
⭐ 0· 836·1 current·1 all-time
by@wpank
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (quality gates for pre-commit through post-deploy) matches the SKILL.md: it contains concrete gate definitions, pre-commit and CI examples, security and performance checks, and coverage thresholds. There are no unrelated requirements (no env vars, no binaries requested) that contradict the stated purpose.
Instruction Scope
Instructions are focused on configuring pre-commit hooks, CI pipelines, coverage thresholds, and security/perf scans. They instruct running repository-scanning tools (gitleaks, truffleHog, detect-secrets),npm/pip audits, and CI checks — all relevant. Note: those steps will read repository contents and CI artifacts and some deployment sections implicitly assume you will provide CI/deploy credentials (not declared here). The guide does not instruct the agent to access unrelated system files or hidden credentials.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. Nothing will be downloaded or written by the skill itself, so there is low supply-chain risk from the skill package.
Credentials
The skill declares no required environment variables or credentials, which is proportional for documentation. However, following its deployment and CI instructions in practice will require you to supply CI runner secrets and cloud credentials (this is normal but outside the skill). The skill does not attempt to collect or require those credentials itself.
Persistence & Privilege
No special runtime privileges are requested: always/disable-model-invocation are not set and the skill is not forced into every run. It's an on-demand, instruction-only guide.
Assessment
This is a documentation-only skill that provides recipes for pre-commit hooks and CI quality gates — it appears coherent and safe as-is. Before you adopt its recommendations: review any hook scripts and GitHub Actions it suggests (pin action versions, prefer official authors), verify third-party tools (gitleaks, trivy, trufflehog, etc.) come from trusted sources, and apply least-privilege to any CI or deploy tokens you create. Also be aware that some recommended gates (e.g., 100% E2E coverage or strict deploy automation) may be unrealistic for your project; adapt thresholds accordingly. Because the skill does not request credentials, installing it won’t expose secrets by itself, but implementing its CI/deploy recipes will require you to supply credentials to your CI/CD system — handle those secrets per your security policies.Like a lobster shell, security has layers — review code before you run it.
latestvk974dcdhfa6xgjma9pse9tf2c580xc67
License
MIT-0
Free to use, modify, and redistribute. No attribution required.