[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698QWSFRRFC27MFGQ54ZNX3":3,"skill-same:01M698QWSFRRFC27MFGQ54ZNX3":54},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":26,"linkOnly":27,"markdownContent":28,"markdownBody":29,"frontMatter":30,"refName":31,"commitSha":32,"skillDirectory":33,"forksCount":34,"repositoryHtmlUrl":35,"repositoryHomepageUrl":36,"ownerHtmlUrl":37,"ownerBlogUrl":36,"ownerDescription":38,"updatedAt":39,"install":40,"resources":53},"01M698QWSFRRFC27MFGQ54ZNX3","openclaw-ghsa-maintainer",null,"Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state.","openclaw\u002Fopenclaw","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","01M698P3FSAZ6B4R928ZF19KPT","01M698PDMDRVH56MV30D253NFP",394302,"MIT","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-ghsa-maintainer\u002FSKILL.md",[],[9,18,19,20,21,22,23,24,25],"openclaw ghsa maintainer","security","validate","state","publish","patch","inspect","fork","2026-11-10 10:12:30",false,"---\nname: openclaw-ghsa-maintainer\ndescription: \"Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state.\"\n---\n\n# OpenClaw GHSA Maintainer\n\nUse this skill for repo security advisory workflow only. Keep general release work in `release-openclaw-maintainer`.\n\n## Respect advisory guardrails\n\n- Before reviewing or publishing a repo advisory, read `SECURITY.md`.\n- Ask permission before any publish action.\n- Treat this skill as GHSA-only. Do not use it for stable or beta release work.\n\n## Fetch and inspect advisory state\n\nFetch the current advisory and the latest published npm version:\n\n```bash\ngh api \u002Frepos\u002Fopenclaw\u002Fopenclaw\u002Fsecurity-advisories\u002F\u003CGHSA>\nnpm view openclaw version --userconfig \"$(mktemp)\"\n```\n\nUse the fetch output to confirm the advisory state, linked private fork, and vulnerability payload shape before patching.\n\n## Verify private fork PRs are closed\n\nBefore publishing, verify that the advisory's private fork has no open PRs:\n\n```bash\nfork=$(gh api \u002Frepos\u002Fopenclaw\u002Fopenclaw\u002Fsecurity-advisories\u002F\u003CGHSA> | jq -r .private_fork.full_name)\ngh pr list -R \"$fork\" --state open\n```\n\nThe PR list must be empty before publish.\n\n## Prepare advisory Markdown and JSON safely\n\n- Write advisory Markdown via heredoc to a temp file. Do not use escaped `\\n` strings.\n- Build PATCH payload JSON with `jq`, not hand-escaped shell JSON.\n\nExample pattern:\n\n```bash\ncat > \u002Ftmp\u002Fghsa.desc.md \u003C\u003C'EOF'\n\u003Cmarkdown description>\nEOF\n\njq -n --rawfile desc \u002Ftmp\u002Fghsa.desc.md \\\n  '{summary,severity,description:$desc,vulnerabilities:[...]}' \\\n  > \u002Ftmp\u002Fghsa.patch.json\n```\n\n## Apply PATCH calls in the correct sequence\n\n- Do not set `severity` and `cvss_vector_string` in the same PATCH call.\n- Use separate calls when the advisory requires both fields.\n- Publish by PATCHing the advisory and setting `\"state\":\"published\"`. There is no separate `\u002Fpublish` endpoint.\n\nExample shape:\n\n```bash\ngh api -X PATCH \u002Frepos\u002Fopenclaw\u002Fopenclaw\u002Fsecurity-advisories\u002F\u003CGHSA> \\\n  --input \u002Ftmp\u002Fghsa.patch.json\n```\n\n## Publish and verify success\n\nAfter publish, re-fetch the advisory and confirm:\n\n- `state=published`\n- `published_at` is set\n- the description does not contain literal escaped `\\\\n`\n\nVerification pattern:\n\n```bash\ngh api \u002Frepos\u002Fopenclaw\u002Fopenclaw\u002Fsecurity-advisories\u002F\u003CGHSA>\njq -r .description \u003C \u002Ftmp\u002Fghsa.refetch.json | rg '\\\\\\\\n'\n```\n\n## Common GHSA footguns\n\n- Publishing fails with HTTP 422 if required fields are missing or the private fork still has open PRs.\n- A payload that looks correct in shell can still be wrong if Markdown was assembled with escaped newline strings.\n- Advisory PATCH sequencing matters; separate field updates when GHSA API constraints require it.\n- Public hardening\u002Fno-publish comments and draft text should avoid raw commit hashes, PR titles\u002Fnumbers, and fix-mechanism summaries. Prefer patched-version fields or release-only wording; keep SHAs, PRs, and implementation notes in internal evidence.\n","# OpenClaw GHSA Maintainer\n\nUse this skill for repo security advisory workflow only. Keep general release work in `release-openclaw-maintainer`.\n\n## Respect advisory guardrails\n\n- Before reviewing or publishing a repo advisory, read `SECURITY.md`.\n- Ask permission before any publish action.\n- Treat this skill as GHSA-only. Do not use it for stable or beta release work.\n\n## Fetch and inspect advisory state\n\nFetch the current advisory and the latest published npm version:\n\n```bash\ngh api \u002Frepos\u002Fopenclaw\u002Fopenclaw\u002Fsecurity-advisories\u002F\u003CGHSA>\nnpm view openclaw version --userconfig \"$(mktemp)\"\n```\n\nUse the fetch output to confirm the advisory state, linked private fork, and vulnerability payload shape before patching.\n\n## Verify private fork PRs are closed\n\nBefore publishing, verify that the advisory's private fork has no open PRs:\n\n```bash\nfork=$(gh api \u002Frepos\u002Fopenclaw\u002Fopenclaw\u002Fsecurity-advisories\u002F\u003CGHSA> | jq -r .private_fork.full_name)\ngh pr list -R \"$fork\" --state open\n```\n\nThe PR list must be empty before publish.\n\n## Prepare advisory Markdown and JSON safely\n\n- Write advisory Markdown via heredoc to a temp file. Do not use escaped `\\n` strings.\n- Build PATCH payload JSON with `jq`, not hand-escaped shell JSON.\n\nExample pattern:\n\n```bash\ncat > \u002Ftmp\u002Fghsa.desc.md \u003C\u003C'EOF'\n\u003Cmarkdown description>\nEOF\n\njq -n --rawfile desc \u002Ftmp\u002Fghsa.desc.md \\\n  '{summary,severity,description:$desc,vulnerabilities:[...]}' \\\n  > \u002Ftmp\u002Fghsa.patch.json\n```\n\n## Apply PATCH calls in the correct sequence\n\n- Do not set `severity` and `cvss_vector_string` in the same PATCH call.\n- Use separate calls when the advisory requires both fields.\n- Publish by PATCHing the advisory and setting `\"state\":\"published\"`. There is no separate `\u002Fpublish` endpoint.\n\nExample shape:\n\n```bash\ngh api -X PATCH \u002Frepos\u002Fopenclaw\u002Fopenclaw\u002Fsecurity-advisories\u002F\u003CGHSA> \\\n  --input \u002Ftmp\u002Fghsa.patch.json\n```\n\n## Publish and verify success\n\nAfter publish, re-fetch the advisory and confirm:\n\n- `state=published`\n- `published_at` is set\n- the description does not contain literal escaped `\\\\n`\n\nVerification pattern:\n\n```bash\ngh api \u002Frepos\u002Fopenclaw\u002Fopenclaw\u002Fsecurity-advisories\u002F\u003CGHSA>\njq -r .description \u003C \u002Ftmp\u002Fghsa.refetch.json | rg '\\\\\\\\n'\n```\n\n## Common GHSA footguns\n\n- Publishing fails with HTTP 422 if required fields are missing or the private fork still has open PRs.\n- A payload that looks correct in shell can still be wrong if Markdown was assembled with escaped newline strings.\n- Advisory PATCH sequencing matters; separate field updates when GHSA API constraints require it.\n- Public hardening\u002Fno-publish comments and draft text should avoid raw commit hashes, PR titles\u002Fnumbers, and fix-mechanism summaries. Prefer patched-version fields or release-only wording; keep SHAs, PRs, and implementation notes in internal evidence.\n",{"name":5,"description":7},"main","f1c93577085244aa96aa87b53a2df9b59d293bd7",".agents\u002Fskills\u002Fopenclaw-ghsa-maintainer",82862,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw","https:\u002F\u002Fopenclaw.ai","https:\u002F\u002Fgithub.com\u002Fopenclaw","Your personal, open source AI assistant.","2026-11-11 08:46:30",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add openclaw\u002Fopenclaw --skill openclaw-ghsa-maintainer",{"tool":46,"command":47},"bunx","bunx skills add openclaw\u002Fopenclaw --skill openclaw-ghsa-maintainer",{"tool":49,"command":50},"pnpm","pnpm dlx skills add openclaw\u002Fopenclaw --skill openclaw-ghsa-maintainer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-ghsa-maintainer\u002FSKILL.md",true,[],[55,61,84,102,124,148],{"skillNo":56,"name":57,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":58,"categories":59,"keywords":60,"publishedAt":26},"01M698VP84FNM6G9MR1HPX7MF7","lobster","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fextensions\u002Flobster\u002FSKILL.md",[],[57],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":26},"01M698YY8QGQ7S8TJNKJG6VTPH","xurl","xurl CLI for authenticated X posts, replies, reads\u002Fsearch, DMs, media upload, followers, auth status, or raw v2 API calls.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fxurl\u002FSKILL.md",[],[63,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83],"for","api","calls","replies","posts","upload","tap","install","brew","node","Media","search","npm","status","auth","cli",{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":26},"01M698YWT1CJ0WK88WB909R9RT","weather","Current weather and forecasts with web_fetch, falling back to wttr.in curl for locations, rain, temperature, travel planning.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fweather\u002FSKILL.md",[],[86,91,92,75,93,76,94,95,96,97,98,99,68,100,101],"travel planning","travel","fetch","curl","https","help","planning","web","back","temperature","with",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":113,"publishedAt":26},"01M698YV2Q0R0JJKAWGFS21K0N","visualize","Create inline visuals for code and explanations, or author persistent OpenClaw dashboard widgets with show_widget.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fvisualize\u002FSKILL.md",[108],{"categoryNo":109,"categoryName":110,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[104,114,115,116,117,68,101,118,119,120,121,122,9,123],"widgets","openclaw dashboard","author","inline","show","code","create","visuals","dashboard","widget",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":138,"publishedAt":26},"01M698YS2TRJH9ENG28HD9CD87","trello","Manage Trello boards, lists, and cards via the Trello REST API.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Ftrello\u002FSKILL.md",[130,135],{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":136,"categoryName":137,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000030","开发工程师",[126,95,139,140,141,142,143,144,75,76,145,94,69,146,147],"cloud","manage","via","rest api","token","atlassian","jq","REST","developer",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":26},"01M698YQ9Q3M4W78EWV2KSCSVW","tmux","Control tmux sessions\u002Fpanes for interactive CLIs: list, capture output, send keys, paste text, monitor prompts.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Ftmux\u002FSKILL.md",[],[150,75,155,156,68,157,158,159,160,161,162,163,76,164,165,166,167,168,169],"send","darwin","keys","paste","output","control","prompts","interactive","list","capture","panes","text","monitor","sessions","linux"]