openclaw-ghsa-maintainer
Maintainer workflow for OpenClaw GitHub Security Advisories (GHSA). Use when Codex needs to inspect, patch, validate, or publish a repo advisory, verify private-fork state, prepare advisory Markdown or JSON payloads safely, handle GHSA API-specific publish constraints, or confirm advisory publish success.
npx skills add SafeAI-Lab-X/ClawKeeper --skill openclaw-ghsa-maintainer --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# OpenClaw GHSA Maintainer Use this skill for repo security advisory workflow only. Keep general release work in `openclaw-release-maintainer`. ## Respect advisory guardrails - Before reviewing or publishing a repo advisory, read `SECURITY.md`. - Ask permission before any publish action. - Treat this skill as GHSA-only. Do not use it for stable or beta release work. ## Fetch and inspect advisory state Fetch the current advisory and the latest published npm version: ```bash gh api /repos/openclaw/openclaw/security-advisories/<GHSA> npm view openclaw version --userconfig "$(mktemp)" ``` Use the fetch output to confirm the advisory state, linked private fork, and vulnerability payload shape before patching. ## Verify private fork PRs are closed Before publishing, verify that the advisory's private fork has no open PRs: ```bash fork=$(gh api /repos/openclaw/openclaw/security-advisories/<GHSA> | jq -r .private_fork.full_name) gh pr list -R "$fork" --state open ``` The PR list must be empty before publish. ## Prepare advisory Markdown and JSON safely - Write advisory Markdown via heredoc to a temp file. Do not use escaped `\n` strings. - Build PATCH payload JSON with `jq`, not hand-escap
- Respect advisory guardrails
- Fetch and inspect advisory state
- Verify private fork PRs are closed
- Prepare advisory Markdown and JSON safely
- Apply PATCH calls in the correct sequence
- Publish and verify success
- Common GHSA footguns
gh api /repos/openclaw/openclaw/security-advisories/<GHSA> npm view openclaw version --userconfig "$(mktemp)" gh pr list -R "$fork" --state open cat > /tmp/ghsa.desc.md <<'EOF' jq -n --rawfile desc /tmp/ghsa.desc.md \ gh api -X PATCH /repos/openclaw/openclaw/security-advisories/<GHSA> \ jq -r .description < /tmp/ghsa.refetch.json | rg '\\\\n'
What does the openclaw-ghsa-maintainer skill do?
Maintainer workflow for OpenClaw GitHub Security Advisories (GHSA). Use when Codex needs to inspect, patch, validate, or publish a repo advisory, verify private-fork state, prepare advisory Markdown or JSON payloads safely, handle GHSA API-specific publish constraints, or confirm advisory publish success.
How do I install it?
Run `npx skills add SafeAI-Lab-X/ClawKeeper --skill openclaw-ghsa-maintainer --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From SafeAI-Lab-X/ClawKeeper, a repository with 1,034 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.