Openclaw Rd Pipeline
Analysis
This workflow is coherent, but it should be reviewed because it can update Feishu work items and use repository permissions to implement code, push branches, and open PRs through subagents.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
create Feishu master task/doc ... commit and push feature branch ... open PR to production branch
The skill directs the agent to mutate Feishu workflow state and repository state. These actions are central to the purpose, but they are high-impact and the artifact does not require explicit approval before each push, PR, task update, or bug-loop mutation.
Use an isolated git worktree and dedicated tmux session per subagent.
Dedicated tmux sessions and subagents are disclosed and purpose-aligned, but tmux sessions can persist beyond a single command and the artifact does not describe cleanup after closure.
For multi-module or multi-scenario tasks, call Superpowers skill for decomposition
The artifact references an optional external skill that is not included, version-pinned, or declared in the install metadata. The fallback is manual decomposition, so this is a dependency awareness note rather than evidence of malicious behavior.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Required env vars: none ... Primary credential: none
The registry metadata declares no credential contract, while the SKILL.md workflow requires Feishu and Git authority to create tasks, push branches, and open PRs. This is expected for the integration, but users should not assume no account permissions are involved.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Query historical tasks in same Feishu group ... Load project Feishu wiki docs ... Reuse prior parsing logic
The workflow intentionally pulls private historical tasks and wiki content into the project context and refined prompt. This is useful for R&D work, but retrieved content can be sensitive and may influence downstream implementation decisions.