openclaw-ghsa-maintainer

Name: openclaw-ghsa-maintainer
Author: SafeAI-Lab-X

1.0kstars58forks

How to install openclaw-ghsa-maintainer?

safeai-lab-x/clawkeeper/openclaw-ghsa-maintainer

$npx -y skills add SafeAI-Lab-X/ClawKeeper --skill openclaw-ghsa-maintainer

Installs into the current project.

Summary

Maintainer workflow for OpenClaw GitHub Security Advisories (GHSA). Use when Codex needs to inspect, patch, validate, or publish a repo advisory, verify private-fork state, prepare advisory Markdown or JSON payloads safely, handle GHSA API-specific publish constraints, or confirm

Files · 1

View on GitHub

SKILL.md

1	# OpenClaw GHSA Maintainer
2
3	Use this skill for repo security advisory workflow only. Keep general release work in `openclaw-release-maintainer`.
4
5	## Respect advisory guardrails
6
7	- Before reviewing or publishing a repo advisory, read `SECURITY.md`.
8	- Ask permission before any publish action.
9	- Treat this skill as GHSA-only. Do not use it for stable or beta release work.
10
11	## Fetch and inspect advisory state
12
13	Fetch the current advisory and the latest published npm version:
14
15	```bash
16	gh api /repos/openclaw/openclaw/security-advisories/<GHSA>
17	npm view openclaw version --userconfig "$(mktemp)"
18	```
19
20	Use the fetch output to confirm the advisory state, linked private fork, and vulnerability payload shape before patching.
21
22	## Verify private fork PRs are closed
23
24	Before publishing, verify that the advisory's private fork has no open PRs:
25
26	```bash
27	fork=$(gh api /repos/openclaw/openclaw/security-advisories/<GHSA> \| jq -r .private_fork.full_name)
28	gh pr list -R "$fork" --state open
29	```
30
31	The PR list must be empty before publish.
32
33	## Prepare advisory Markdown and JSON safely
34
35	- Write advisory Markdown via heredoc to a temp file. Do not use escaped `\n` strings.
36	- Build PATCH payload JSON with `jq`, not hand-escaped shell JSON.
37
38	Example pattern:
39
40	```bash
41	cat > /tmp/ghsa.desc.md <<'EOF'
42	<markdown description>
43	EOF
44
45	jq -n --rawfile desc /tmp/ghsa.desc.md \
46	'{summary,severity,description:$desc,vulnerabilities:[...]}' \
47	> /tmp/ghsa.patch.json
48	```
49
50	## Apply PATCH calls in the correct sequence
51
52	- Do not set `severity` and `cvss_vector_string` in the same PATCH call.
53	- Use separate calls when the advisory requires both fields.
54	- Publish by PATCHing the advisory and setting `"state":"published"`. There is no separate `/publish` endpoint.
55
56	Example shape:
57
58	```bash
59	gh api -X PATCH /repos/openclaw/openclaw/security-advisories/<GHSA> \
60	--input /tmp/ghsa.patch.json
61	```
62
63	## Publish and verify success
64
65	After publish, re-fetch the advisory and confirm:
66
67	- `state=published`
68	- `published_at` is set
69	- the description does not contain literal escaped `\\n`
70
71	Verification pattern:
72
73	```bash
74	gh api /repos/openclaw/openclaw/security-advisories/<GHSA>
75	jq -r .description < /tmp/ghsa.refetch.json \| rg '\\\\n'
76	```
77
78	## Common GHSA footguns
79
80	- Publishing fails with HTTP 422 if required fields are missing or the private fork still has open PRs.
81	- A payload that looks correct in shell can still be wrong if Markdown was assembled with escaped newline strings.
82	- Advisory PATCH sequencing matters; separate field updates when GHSA API constraints require it.

People who liked this also viewed

6 picks

Type

openclaw-ghsa-maintainer

1.0kstars58forks

View on GitHub

How to install openclaw-ghsa-maintainer?

safeai-lab-x/clawkeeper/openclaw-ghsa-maintainer

$npx -y skills add SafeAI-Lab-X/ClawKeeper --skill openclaw-ghsa-maintainer

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# OpenClaw GHSA Maintainer
2
3	Use this skill for repo security advisory workflow only. Keep general release work in `openclaw-release-maintainer`.
4
5	## Respect advisory guardrails
6
7	- Before reviewing or publishing a repo advisory, read `SECURITY.md`.
8	- Ask permission before any publish action.
9	- Treat this skill as GHSA-only. Do not use it for stable or beta release work.
10
11	## Fetch and inspect advisory state
12
13	Fetch the current advisory and the latest published npm version:
14
15	```bash
16	gh api /repos/openclaw/openclaw/security-advisories/<GHSA>
17	npm view openclaw version --userconfig "$(mktemp)"
18	```
19
20	Use the fetch output to confirm the advisory state, linked private fork, and vulnerability payload shape before patching.
21
22	## Verify private fork PRs are closed
23
24	Before publishing, verify that the advisory's private fork has no open PRs:
25
26	```bash
27	fork=$(gh api /repos/openclaw/openclaw/security-advisories/<GHSA> \| jq -r .private_fork.full_name)
28	gh pr list -R "$fork" --state open
29	```
30
31	The PR list must be empty before publish.
32
33	## Prepare advisory Markdown and JSON safely
34
35	- Write advisory Markdown via heredoc to a temp file. Do not use escaped `\n` strings.
36	- Build PATCH payload JSON with `jq`, not hand-escaped shell JSON.
37
38	Example pattern:
39
40	```bash
41	cat > /tmp/ghsa.desc.md <<'EOF'
42	<markdown description>
43	EOF
44
45	jq -n --rawfile desc /tmp/ghsa.desc.md \
46	'{summary,severity,description:$desc,vulnerabilities:[...]}' \
47	> /tmp/ghsa.patch.json
48	```
49
50	## Apply PATCH calls in the correct sequence
51
52	- Do not set `severity` and `cvss_vector_string` in the same PATCH call.
53	- Use separate calls when the advisory requires both fields.
54	- Publish by PATCHing the advisory and setting `"state":"published"`. There is no separate `/publish` endpoint.
55
56	Example shape:
57
58	```bash
59	gh api -X PATCH /repos/openclaw/openclaw/security-advisories/<GHSA> \
60	--input /tmp/ghsa.patch.json
61	```
62
63	## Publish and verify success
64
65	After publish, re-fetch the advisory and confirm:
66
67	- `state=published`
68	- `published_at` is set
69	- the description does not contain literal escaped `\\n`
70
71	Verification pattern:
72
73	```bash
74	gh api /repos/openclaw/openclaw/security-advisories/<GHSA>
75	jq -r .description < /tmp/ghsa.refetch.json \| rg '\\\\n'
76	```
77
78	## Common GHSA footguns
79
80	- Publishing fails with HTTP 422 if required fields are missing or the private fork still has open PRs.
81	- A payload that looks correct in shell can still be wrong if Markdown was assembled with escaped newline strings.
82	- Advisory PATCH sequencing matters; separate field updates when GHSA API constraints require it.

People who liked this also viewed

6 picks

Type