Deterministic end-to-end test skill for validating CLI publish lifecycle and verifying registry and metadata round-trips.
Security Analysis
medium confidenceThe skill's declared purpose (deterministic end-to-end testing of a publish lifecycle) matches its minimal requirements — it is an instruction-only test helper that requests no credentials or installs — but the instructions are very sparse and incomplete.
Name and description claim an e2e test for CLI publish/install/update/delete and registry metadata. The skill requests no binaries, env vars, or installs, which is consistent for a simple instruction-only test helper.
SKILL.md contains only high-level steps ('Install the skill', 'Run the listed command examples', 'Confirm output') but provides no concrete command examples or targets. This vagueness gives the agent broad discretion at runtime and is incomplete for a deterministic test — not malicious but potentially risky if you expect automated execution without seeing exact commands.
No install spec and no code files — lowest-risk pattern (instruction-only). Nothing is written to disk by installation because there is no installer.
The skill declares no required environment variables, credentials, or config paths. There is no indication it needs access to external secrets or systems.
always is false, user-invocable is true, and model invocation is allowed (normal defaults). The skill does not request persistent presence or elevated system privileges.
Guidance
This skill appears to be what it says — a minimal e2e test helper with no credentials or installs — but the runtime instructions are incomplete (no concrete commands or expected outputs are provided). Before installing or allowing autonomous runs: 1) ask the publisher for the exact command examples and expected output, 2) review those commands yourself to ensure they don't touch systems you don't want tested, and 3) run the test in a sandbox or isolated environment first. If you plan to let the agent invoke the skill autonomously, require explicit, auditable command lists to avoid unintended actions.
Latest Release
v1.0.0
Initial release of e2e-repro3-1772127182276: - Provides a deterministic end-to-end test skill for ClawHub publish lifecycle. - Supports validation of CLI publish, install, update, and delete behavior. - Useful for verifying registry and metadata round-trips. - Includes clear usage instructions and expected outcomes for testing.
More by @VACInc
Published by @VACInc on ClawHub
