security-triage
Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.
npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Triage Use when reviewing OpenClaw security advisories, drafts, or GHSA reports. Goal: high-confidence maintainers' triage without over-closing real issues or shipping unnecessary regressions. ## Close Bar Close only if one of these is true: - duplicate of an existing advisory or fixed issue - invalid against shipped behavior - out of scope under `SECURITY.md` - fixed before any affected release/tag Do not close only because `main` is fixed. If latest shipped tag or npm release is affected, keep it open until released or published with the right status. ## Required Reads Before answering: 1. Read `SECURITY.md`. 2. Read the GHSA body with `gh api /repos/openclaw/openclaw/security-advisories/<GHSA>`. 3. Inspect the exact implicated code paths. 4. Verify shipped state: - `git tag --sort=-creatordate | head` - `npm view openclaw version --userconfig "$(mktemp)"` - `git tag --contains <fix-commit>` - if needed: `git show <tag>:path/to/file` 5. Search for canonical overlap: - existing published GHSAs - older fixed bugs - same trust-model class already covered in `SECURITY.md` ## Review Method For each advisory, decide: - `close` - `keep open` - `keep open but narrow` Check in
- Close Bar
- Required Reads
- Review Method
- Response Format
- Clipboard Step
- Useful Commands
- Decision Notes
pbcopy <<'EOF' gh api /repos/openclaw/openclaw/security-advisories/<GHSA> gh api /repos/openclaw/openclaw/security-advisories --paginate git tag --sort=-creatordate | head -n 20 npm view openclaw version --userconfig "$(mktemp)" git tag --contains <commit> git show <tag>:<path> gh search issues --repo openclaw/openclaw --match title,body,comments -- "<terms>" gh search prs --repo openclaw/openclaw --match title,body,comments -- "<terms>"
What does the security-triage skill do?
Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.
How do I install it?
Run `npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From SafeAI-Lab-X/ClawKeeper, a repository with 1,034 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.