Agent skill · security · steipete
security-triage
Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.
Why this skill is useful
Provides a detailed triage process for OpenClaw security advisories that includes specific commands and checks not commonly known.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 385,400 stars on the source repository.
What this skill does
Security Triage Use when reviewing OpenClaw security advisories, drafts, or GHSA reports. Goal: high-confidence maintainers' triage without over-closing real issues or shipping unnecessary regressions. Close Bar Close only if one of these is true: duplicate of an existing advisory or fixed issue invalid against shipped behavior out of scope under SECURITY.md fixed before any affected release/tag Do not close only because main is fixed. If latest shipped tag or npm release is affected, keep it open until released or published with the right status. Required Reads Before answering: 1. Read SECURITY.md. 2. Read the GHSA body with gh api /repos/openclaw/openclaw/security-advisories/<GHSA>. 3. Inspect the exact implicated code paths. 4. Verify shipped state: git tag --sort=-creatordate head npm view openclaw version --userconfig "$(mktemp)" git tag --contains <fix-commit> if needed: git show <tag>:path/to/file 5. Search for canonical overlap: existing published GHSAs older fixed bugs same trust-model class already covered in SECURITY.md Review Method For each advisory, decide: close keep open keep open but narrow Default to one advisory at a time when comments/closures are involved: 1. Review exactly one GHSA. 2. Print the GHSA URL first. 3. Summarize the decision and evidence for discussion. 4. Draft one maintainer-ready comment. 5. Copy only that one comment to the clipboard. 6. Stop and wait for Peter to post/discuss before moving to the next GHSA. Do not batch multiple close comments unless Peter explicitly asks for a batch. Check in this order: 1. Trust model Is the prerequisite already inside trusted host/local/plugin/operator state? Does SECURITY.md explicitly call this class out as out of scope or hardening-only? 2. Shipped behavior Is the bug present in the latest shipped tag or npm release? Was it fixed before release? 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills steipete/security-triage