Agent skill · security · steipete
openclaw-secret-scanning-maintainer
Triage, redact, clean up, and resolve OpenClaw GitHub Secret Scanning alerts in issues or PRs.
Why this skill is useful
Adds a comprehensive script for automating the triage and resolution of GitHub Secret Scanning alerts, which includes specific API calls and security measures not commonly found in public documentation.
What it needs
Requires node installed locally. Requires github account access. About 5k tokens when loaded. Last updated 2026-08-07. 385,400 stars on the source repository.
What this skill does
OpenClaw Secret Scanning Maintainer Maintainer-only. This skill requires repo admin / maintainer permissions to edit or delete other users' comments and resolve secret scanning alerts. Use this skill when processing alerts from https://github.com/openclaw/openclaw/security/secret-scanning. Language rule: All notification comments and replacement comments MUST be written in English. Script All mechanical operations (API calls, temp file management, security enforcements) are handled by: The script enforces: hidesecret=true on all alert fetches (no plaintext secrets in stdout) mktemp with random UUIDs for all temp files -F body=@file for all body uploads (no inline shell quoting) Notification templates branched by location type Never prints .secret or .body to stdout Overall Flow Supports single or multiple alerts. For multiple alerts, process in ascending order. For each alert: 1. Identify — fetch-alert + fetch-content to get metadata and body 2. Decide — Agent reads the body file, identifies whether plaintext secrets remain, and produces a redacted version only when needed 3. Redact — redact-body-if-needed for issue/PR body; skip for comments (delete directly) 4. Purge — delete-comment + recreate-comment for comments; cannot purge body history 5. Notify — notify posts the right template per location type, unless the current issue/PR body is already redacted 6. Resolve — resolve closes the alert 7. Summary — summary prints formatted results Step 1: Identify The fetch-content output includes: bodyfile: path to temp file with full body content author: who posted it issuenumber / prnumber: where it is edithistorycount: number of existing edits type: location type for routing For discussioncomment, it also includes commentnodeid, discussionnodeid, and replytonodeid when the original comment was a reply. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills steipete/openclaw-secret-scanning-maintainer