Software Developer — Project Skill

Credential Trust Model

This skill does not access, store, request, or transmit any credentials or secrets.

All external operations — git repository access, Asana task management — are performed exclusively by separately installed dependency skills (a Git skill and an Asana skill). Those skills hold and use their own credentials, supplied by the agent operator through the agent runtime environment. This skill provides workflow instructions only. It never reads environment variables, never receives token values, and never calls external endpoints itself.

The env var names referenced in this skill (GitHub PAT label, Asana PAT label) are identifiers that tell the dependency skills which credential to use — this skill never sees the values behind those names.

Agent Workspace Files

This skill references two operator-provisioned agent workspace files:

• USER.md — contains the agent's active project list, Asana project GIDs, repo URLs, team agent IDs, and which repos this agent can access. Created and maintained by the agent operator (or by the build-development-team skill during setup). This skill reads guidance from it at runtime but does not create or modify it.
• TOOLS.md — contains the agent's available dependency skills and which credential label each one uses. Created and maintained by the operator. This skill does not create or modify it.

Both files live in the agent's workspace directory managed by the OpenClaw operator. They contain no secret values — only project identifiers, GIDs, repo URLs, and env var name references.