Is release-openclaw-skill safe to install?

SaferSkills independently audited release-openclaw-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/release-openclaw-skill/SKILL.md · 1 file

.claude/skills/release-openclaw-skill/SKILL.md2.0 KB · Markdown

name: release-openclaw-skill

description: Release a new version of the OpenClaw skill in `tapo-mcp/openclaw-skill/` by bumping its version, committing, and publishing via `npx clawhub`

Release OpenClaw skill

Release a new version of the OpenClaw skill in tapo-mcp/openclaw-skill/ to ClawHub.

Steps

Determine the new version. Read:

The current skill version from the version: field in tapo-mcp/openclaw-skill/SKILL.md frontmatter.
The current tapo-mcp server version from tapo-mcp/Cargo.toml.

Suggest matching the tapo-mcp version. Ask the user to confirm or supply a different version. ClawHub validates version uniqueness on publish (not monotonic ordering) — any semver string that hasn't been published before for this skill is accepted.

Bump the version.

If the new version differs from the existing version: in tapo-mcp/openclaw-skill/SKILL.md, update the frontmatter.
Update the "v0.X.X or later" minimum-server pin in the Setup section of tapo-mcp/openclaw-skill/SKILL.md to match the current tapo-mcp server version from step 1. This is a separate field from the skill's own version: — the pin tracks the MCP server version, not the skill version.

Determine the changelog summary. Look at recent commits affecting the skill directory:

   git log --oneline -10 -- tapo-mcp/openclaw-skill/

Propose a one-sentence summary of what's new in this release and ask the user to confirm or refine. This text is passed to --changelog at publish time and stored on ClawHub per version.

Commit pending changes. If the version bump (or any other prep) left uncommitted changes, run /commit with message chore(tapo-mcp): release openclaw skill vX.X.X. Skip this step if there is nothing to commit.

Publish. Ask the user for confirmation, then:

   npx clawhub publish tapo-mcp/openclaw-skill \
     --slug tapo \
     --name "Tapo" \
     --version X.X.X \
     --tags "tapo,smart-home,iot,mcporter" \
     --changelog "<summary from step 3>"

release-openclaw-skill— agent skill

Is release-openclaw-skill safe to install?

Release OpenClaw skill

Steps

Audit the pieces. Scan the whole. Decide.