Dev Project Manager Skill

Credential Trust Model

This skill does not access, store, request, or transmit any credentials or secrets.

All external API calls — Asana task management, email delivery — are performed exclusively by separately installed dependency skills (an Asana skill and an Email skill). Those skills hold and use their own credentials, supplied by the agent operator through the agent runtime environment. This skill provides workflow instructions only. It never reads environment variables, never receives token values, and never calls external endpoints itself.

The env var names referenced in this skill (such as Asana PAT and Dev Manager email vars) are labels that identify which credential the dependency skills should use — this skill never sees the values behind those names.

Agent Workspace Files

This skill references two operator-provisioned agent workspace files:

• USER.md — contains the agent's active project list, Asana project GIDs, repo URLs, and team agent IDs. This file is created and maintained by the agent operator (or by the build-development-team skill during setup). This skill reads guidance from it at runtime but does not create or modify it.
• TOOLS.md — contains the agent's available tools and which credential labels each dependency skill uses. Created and maintained by the operator. This skill does not create or modify it.

Both files live in the agent's workspace directory, managed by the OpenClaw operator. They contain no secret values — only project identifiers, GIDs, repo URLs, and env var name references.