buildlog
SKILLRecord, export, and share your AI coding sessions as replayable buildlogs
Dimension scores
Compatibility
| Framework | Status | Notes |
|---|---|---|
| Claude Code | ✗ | Not an MCP server - this is a skill definition/documentation file only, No server implementation found (no index.js, index.ts, or server executable), No package.json with MCP server configuration, SKILL.md is documentation describing desired commands, not an actual tool implementation, No stdio transport implementation, No MCP protocol implementation |
| OpenAI Agents SDK | ✗ | Not an MCP server - this is a skill definition/documentation file only, No server implementation found, No SSE or HTTP transport implementation, No tool schemas defined, Cannot translate to OpenAI function calling format without actual implementation |
| LangChain | ✗ | Not an MCP server - this is a skill definition/documentation file only, No server implementation found, No tools to wrap as LangChain StructuredTools, Documentation only - no executable code |
Security findings
Potential credential exposure in configuration
Documentation instructs users to add 'apiKey' directly in JSON configuration files. These configuration files are often committed to version control systems, exposing API credentials. No guidance on using environment variables or secure credential storage.
No server implementation provided for security review
The repository only contains documentation (SKILL.md) and metadata (_meta.json). No actual server code is present to validate input handling, authorization checks, or security controls. Cannot verify if the referenced repository (https://github.com/buildlog/openclaw-skill) implements secure practices.
Uncontrolled data exfiltration risk
The skill uploads 'coding sessions' including file contents to an external service (buildlog.ai) with 'includeFileContents: true' as default. No evidence of input validation on what files get uploaded. Users may inadvertently upload sensitive files (credentials, private keys, customer data) without explicit file-by-file consent.
Insufficient access control guidance
Configuration shows 'defaultPublic: true', meaning recordings are public by default. Users may unknowingly share proprietary code, internal implementation details, or sensitive debugging sessions. No clear warnings about what should not be recorded.
Arbitrary file inclusion without size validation
maxFileSizeKb parameter suggests files are included in uploads, but 100KB default is quite large and no validation shown for file types. Could upload binary files, executables, or files with embedded credentials.
Lack of input sanitization specification
Commands accept user input for titles, notes, and annotations ('Start a buildlog [title]', 'Add a note: [text]'). No documentation of input validation, length limits, or sanitization. Potential for injection attacks if these inputs are used in file paths, commands, or database queries.
No authentication model described
Repository link mismatch
Unclear data retention policy
Reliability
Success rate
15%
Calls made
100
Failure modes
- • No actual implementation code provided - only documentation
- • No MCP server executable or source files present
- • No error handling possible without implementation
- • No validation logic for commands or parameters
- • No resource management (file handles, API connections)
- • No handling of edge cases like empty titles, invalid API keys
- • No timeout mechanisms for uploads or API calls
- • Cannot verify API interaction patterns
- • No concurrent request handling
- • Missing all actual tool/prompt/resource definitions
Code health
License
none
Has tests
No
Has CI
No
Dependencies
0
This appears to be a documentation-only skill definition with no actual source code implementation. The repository contains only metadata (_meta.json) and a markdown specification (SKILL.md). There is no executable code, no tests, no CI/CD, no dependencies, and no license file. The SKILL.md references a repository URL (https://github.com/buildlog/openclaw-skill) but no actual source code is present in the provided directory. The _meta.json shows version 1.0.1 was published, but we cannot assess the actual implementation's health. Without source code, we cannot evaluate maintenance activity, code quality, testing, or most other health metrics. The documentation itself is well-structured and comprehensive, but a skill without implementation code cannot be considered healthy from a code maintenance perspective.