#818 by GitHub stars
openclaw/agent-skills
Useful skills for agents and claws.
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/agent-transcript/SKILL.md
Week of Nov 2, 2026 · +5 / −5 lines
Before Network or broad shell → After Network or broad shell
9ac983561588 → 02f3158379a7
+ 22 Resolve `TRANSCRIPT_SKILL_DIR` to the directory containing this `SKILL.md`.
+ 23 Invoke that installation without changing the consumer's working directory.
+ 24
- 23 skills/agent-transcript/scripts/agent-transcript find \
+ 26 "$TRANSCRIPT_SKILL_DIR/scripts/agent-transcript" find \
- 25 skills/agent-transcript/scripts/agent-transcript render \
+ 28 "$TRANSCRIPT_SKILL_DIR/scripts/agent-transcript" render \
- 28
- 29 In downstream repositories that sync under `.agents/skills`, replace
- 30 `skills/agent-transcript` with `.agents/skills/agent-transcript`.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 9ac983561588
No earlier version was observed for comparison.
skills/autoreview/SKILL.md
Week of Nov 2, 2026 · +2 / −1 lines
Before Network or broad shell → After Network or broad shell
9ac983561588 → 02f3158379a7
- 14 ClawSweeper reviews are opt-in for maintainer-authored PRs and issues. Request
+ 14 ClawSweeper's service policy owns automatic review admission, including first
+ 15 reviews of newer maintainer PRs. The rules here govern agent-issued requests. Request
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 9ac983561588
No earlier version was observed for comparison.
skills/beam/SKILL.md
Week of Nov 2, 2026 · +34 / −6 lines
Before Network or broad shell → After Network or broad shell
9ac983561588 → 02f3158379a7
- 3 description: "Publish a redacted local coding session to an authenticated read-only Beam catalog."
+ 3 description: "Share a redacted coding session or hand its logical conversation to an authenticated OpenClaw Gateway."
- 15 - Beam is a read-only projection. Do not connect a node, expose a terminal, resume the local harness remotely, or grant the receiver filesystem/tool access.
+ 15 - Ordinary publishing shares a read-only snapshot. A separately requested `handoff` releases the source Beam identity and moves its logical conversation to Team. After handoff, use Beam's authenticated `read` and `continue` commands for subsequent work; do not resume independent source work or publish another transcript copy.
+ 16 - Team owns one durable conversation after release. The source history imports once; reads, reconnects and continuations resolve that same conversation. Native provider runtime IDs need not survive. Do not connect a node, expose a terminal, transfer credentials or grant filesystem/tool access.
- 17 - Authenticate with `BEAM_ACCESS_TOKEN`, `BEAM_AUTH_TOKEN`, or an interactive `cloudflared access login`. Never print those values.
+ 18 - Guests use their existing personal Cloudflare Access sign-in or `BEAM_ACCESS_TOKEN`; never request, share, or copy a Gateway token for guest uploads. `BEAM_AUTH_TOKEN` remains the ordinary operator Gateway-auth fallback, not a guest credential. Never print token values.
- 25 export BEAM_ENDPOINT="https://example.internal/api/v1/beam/sessions"
+ 26 export BEAM_ENDPOINT="https://gateway.example.com/api/v1/beam/sessions"
+ 68 If the receipt includes `canView: false`, say that the upload succeeded and the link is for authorized Team operators; upload-only access does not let the guest open it. Do not present it as a guest-viewable link. Staff and older receipts may omit `canView`; omission is not a new access grant.
+ 69
+ 70 Guest access requires receiver-side support and operator authorization. Sender support alone does not mean it is deployed.
+ 71 Current Visitor-enabled receivers let active verified publishers create, refresh, list, and read only their own snapshots.
+ 72 They grant no shared-catalog access or deletion. Updated receivers allow authorized continuation of a publisher's own explicitly released Beam, subject to normal destination creation, model, account and session permissions. Older upload-only receivers can return `canView: false`; honor that receipt.
+ 73 Guests need no shared secret. If personal access expires, sign in again outside hooks or refresh the personal `BEAM_ACCESS_TOKEN`.
+ 74 Revoked access needs an authorized operator to restore it. Never blindly retry an uncertain upload.
+ 75
+ 76 ## Live logical handoff
+ 77
+ 78 Only perform this when the user asks to move or continue the conversation in Team; permission to share a snapshot alone is insufficient. Requires Node 22.13+ and an updated receiver.
+ 79
+ 80 ```sh
+ 81 node "$BEAM_SKILL_DIR/scripts/beam" handoff --endpoint "$BEAM_ENDPOINT" --thread-id "$CODEX_THREAD_ID"
+ 82 node "$BEAM_SKILL_DIR/scripts/beam" read --endpoint "$BEAM_ENDPOINT" --beam-id BEAM_ID --profile-dir /path/to/own/remote-profile
+ 83 node "$BEAM_SKILL_DIR/scripts/beam" continue --endpoint "$BEAM_ENDPOINT" --beam-id BEAM_ID --profile-dir /path/to/own/remote-profile --message "Continue the work"
+ 84 ```
+ 85
+ 86 Use `--session-id` for Claude Code. The handoff receipt prints `BEAM_ID`. `--profile-dir` selects an existing normal OpenClaw remote profile for that exact Gateway; configure your own authentication first. No shared account or provider token is requested or copied. Permission or runtime denial stays a denial.
+ 87
+ 88 The helper durably retires this source identity before network dispatch. A pending handoff stays retired after errors; recover with `handoff --endpoint "$BEAM_ENDPOINT" --beam-id BEAM_ID`, including when the source transcript is gone. Never delete the retirement record to retry. Snapshot expiry or archive cannot restore source ownership. A `read` with no destination returns a visible pending result and creates nothing; `continue` creates the destination once. Deleted or reset destinations require reconciliation, not a new transcript copy.
+ 89
+ 90 Source model/version metadata is normalized against models available and permitted at Team. If unavailable, the destination's configured default resolves normally; authentication/setup requirements remain in force. The original local harness is not stopped or remotely controlled. Local turns after handoff are not canonical Team turns.
+ 91
+ 92 Continuation returns the Gateway's normal run acknowledgment. Keep the printed request ID: after an uncertain send, retry the same message with `--request-id ID` to avoid a duplicate turn. `read` obtains the current Team history. The local SQLite record contains only sanitized pending history and ownership metadata; acknowledged history is discarded locally. Default location: the user's `.local/state/openclaw-beam/handoffs.sqlite`; `--state FILE` selects an explicit local store. Preserve it while the handed-off identity can be used.
+ 93
- 82 Hook failures must not block the coding session. Keep them quiet on success; log one concise redacted error on failure.
+ 109 Hook failures must not block the coding session. Keep ordinary success quiet (including upload-only receipts); a retired Beam emits a concise direction to read/continue through Team even with `--quiet`. Log one concise redacted error on failure. Hooks never start interactive authentication or automatically hand off ownership.
- 92 node --test skills/beam/scripts/beam.test.mjs
+ 119 node --check skills/beam/scripts/beam-handoff.js
+ 120 node --test skills/beam/scripts/beam.test.mjs skills/beam/scripts/beam-handoff.test.mjs
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 9ac983561588
No earlier version was observed for comparison.
skills/behavior-validator/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
9ac983561588 → 02f3158379a7
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 9ac983561588
No earlier version was observed for comparison.
skills/crabbox/SKILL.md
Week of Nov 2, 2026 · +16 / −10 lines
Before Network or broad shell → After Network or broad shell
9ac983561588 → 02f3158379a7
- 8 - **PR CI = default broad proof.** First: focused local tests + targeted
- 9 lint/typecheck/format. Checks pass + change builds: open ready PR; CI runs broad
- 10 suites. Never hold PR for pre-PR suite runs.
+ 8 - **PR CI = default broad proof.** Use the consumer repository's proof policy
+ 9 for required checks, builds, and ready/merge gates. Run bounded local checks
+ 10 only when source trust and host qualification permit them.
+ 11 - **Required build unavailable:** remote capacity unavailable + local execution
+ 12 unqualified permits an already-authorized draft with the exact missing build
+ 13 and capacity gap recorded. Require successful exact-head CI covering that build
+ 14 before ready or merge. A skipped draft job is not proof: use the consumer's
+ 15 supported exact-head CI route. This changes proof timing, never publication
+ 16 authority, source trust, credentials, owner approval, or merge gates.
- 13 - Queued: stop task-owned request; run locally. Never wait on queue or chain
- 14 Testbox → AWS → other providers.
+ 19 - Queued: stop task-owned request; use PR CI or a qualified, trusted local scope.
+ 20 Report uncovered requirements. Never wait on queues or chain providers.
- 99 - Native Testbox runs sync even with reused ids. Never rely on `--no-sync` for
- 100 baseline, even unchanged rerun; may be silently ignored.
- 101 - Base/head changed: stop + rewarm; never override stale lease. `warmup --ref`:
+ 105 - Native Testbox runs sync even with reused ids. `--no-sync` is unsupported and
+ 106 exits with code 2 before provider activity. It cannot preserve a remote baseline.
+ 107 - Base/head changed: stop + rewarm; never override stale lease.
+ 108 Crabbox `warmup --blacksmith-ref` (native `blacksmith testbox warmup --ref`):
- 129 failure layers, user-path proof. “Test in Crabbox” = real
- 130 install/update/onboard/CLI/service/API path, not merely remote unit tests.
+ 136 failure layers, and the recipe for requested or consumer-required user-path proof.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 9ac983561588
No earlier version was observed for comparison.
skills/handoff/SKILL.md
Week of Nov 2, 2026 · +19 / −16 lines
Before Network or broad shell → After Network or broad shell
9ac983561588 → 02f3158379a7
- 23 3. Write a standalone prompt for a fresh agent.
+ 23 3. Write a standalone prompt preserving the requested mode, existing authority,
+ 24 accepted decisions, completed proof, remaining work, and completion condition.
- 32 - Start a discussion, not a command-only work order.
- 33 - Ask the receiving agent to do an extensive independent review before changing
- 34 anything.
- 35 - Make clear that the receiving agent owns that review; the handoff only gives
- 36 starting context and known constraints.
- 37 - Ask the agent to decide whether the task is a good idea, stale, already
- 38 solved, over-scoped, or better handled differently.
+ 33 - Preserve the user's requested mode: investigation, discussion, or execution.
+ 34 - Carry existing authorization and its limits without granting new authority.
+ 35 - Ask the receiving agent to verify live state and unresolved assumptions.
+ 36 Size independent review to the remaining uncertainty and repository requirements.
+ 37 - Preserve accepted decisions and completed work unless new evidence invalidates
+ 38 them. An execution handoff must not reset the task to a proposal.
- 56 Use this shape by default:
+ 56 Adapt this shape to the requested mode:
- 59 I want to discuss and possibly work on: <short task title>
+ 59 <Investigate, discuss, or continue execution of>: <short task title>
+ 66 - <existing authority, accepted decisions, completed work, and remaining gaps>
- 67 Before doing any implementation:
+ 68 Resume:
- 71 - Decide whether this task is still real, whether the proposed direction is a good idea, and whether a smaller/better fix exists.
+ 72 - Verify unresolved assumptions without repeating completed work or reopening settled decisions absent new evidence.
- 75 - <what to investigate or implement if the review supports it>
+ 76 - <next investigation or already-authorized implementation>
+ 79 - <completion condition and concrete stop conditions>
- 85 - Start with your review findings and recommendation.
- 86 - Then give the proposed plan or patch summary.
+ 87 - For investigation, report findings and recommendation.
+ 88 - For execution, complete the authorized work and report the result or precise blocker.
- 111 - First real instruction to the receiving agent: review, discuss, assess.
+ 113 - A fresh agent can continue in the requested mode without inventing authority
+ 114 or losing existing authorization.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 9ac983561588
No earlier version was observed for comparison.
skills/readme-standard/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
9ac983561588 → 02f3158379a7
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 9ac983561588
No earlier version was observed for comparison.
skills/session-viewer/SKILL.md
Week of Nov 2, 2026 · +25 / −11 lines
Before Network or broad shell → After Network or broad shell
9ac983561588 → 02f3158379a7
+ 12 Resolve `SESSION_VIEWER_SKILL_DIR` to the directory containing this `SKILL.md`.
+ 13 Use that installed source for commands, independent of the current repository.
+ 14
+ 16 Resolve `TRANSCRIPT_SKILL_DIR` from that skill's actual installation before running:
- 15 .agents/skills/agent-transcript/scripts/agent-transcript find \
+ 19 "$TRANSCRIPT_SKILL_DIR/scripts/agent-transcript" find \
- 23 From a repo that has this skill:
+ 27 Render with the resolved installation:
- 26 node skills/session-viewer/scripts/session-viewer.ts <session.jsonl> --out /tmp/session.html --open
+ 30 node "$SESSION_VIEWER_SKILL_DIR/scripts/session-viewer.ts" <session.jsonl> --out /tmp/session.html --open
- 32 node skills/session-viewer/scripts/session-viewer.ts <session.jsonl> --out session.html
- 33 node skills/session-viewer/scripts/session-viewer.ts <session.jsonl> --raw --out session.html
- 34 node skills/session-viewer/scripts/session-viewer.ts --blank --out viewer.html --open
+ 36 node "$SESSION_VIEWER_SKILL_DIR/scripts/session-viewer.ts" <session.jsonl> --out session.html
+ 37 node "$SESSION_VIEWER_SKILL_DIR/scripts/session-viewer.ts" <session.jsonl> --raw --out session.html
+ 38 node "$SESSION_VIEWER_SKILL_DIR/scripts/session-viewer.ts" --blank --out viewer.html --open
- 36
- 37 In a downstream repo that syncs shared skills under `.agents/skills`, replace
- 38 `skills/session-viewer` with `.agents/skills/session-viewer`.
- 62 OpenClaw/Pi:
+ 63 Current OpenClaw stores session indexes and transcripts in per-agent SQLite databases.
+ 64 Use native session discovery:
+ 65
+ 66 ```bash
+ 67 openclaw sessions --agent "<agentId>" --json
+ 68 ```
+ 69
+ 70 This lists sessions; it does not export a JSONL transcript.
+ 71 The viewer requires a supported JSONL transcript, not a SQLite database or session-list JSON.
+ 72 Use OpenClaw's native session view when no compatible JSONL export is available.
+ 73 See the [OpenClaw sessions reference](https://docs.openclaw.ai/cli/sessions).
+ 74
+ 75 Legacy OpenClaw JSONL:
- 71 Use `sessions.json` in the same directory to map session keys to session ids.
+ 84 Only legacy file stores use `sessions.json` beside those transcripts to map session keys to ids.
+ 85 For standalone Pi, select its actual JSONL transcript rather than assuming the OpenClaw directory layout.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 9ac983561588
No earlier version was observed for comparison.
skills/team-handoff/SKILL.md
Week of Nov 2, 2026 · +6 / −5 lines
Before Network or broad shell → After Network or broad shell
9ac983561588 → 02f3158379a7
- 16 Script: `scripts/team-handoff.sh`
+ 16 Resolve `HANDOFF_SKILL_DIR` to the directory containing this `SKILL.md`.
+ 17 Invoke that installation without changing the consumer's working directory.
- 60 bash scripts/team-handoff.sh probe
- 61 bash scripts/team-handoff.sh create \
+ 61 bash "$HANDOFF_SKILL_DIR/scripts/team-handoff.sh" probe
+ 62 bash "$HANDOFF_SKILL_DIR/scripts/team-handoff.sh" create \
- 65 bash scripts/team-handoff.sh status <sessionKey>
- 66 bash scripts/team-handoff.sh archive <sessionKey> <sessionId>
+ 66 bash "$HANDOFF_SKILL_DIR/scripts/team-handoff.sh" status <sessionKey>
+ 67 bash "$HANDOFF_SKILL_DIR/scripts/team-handoff.sh" archive <sessionKey> <sessionId>
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 9ac983561588
No earlier version was observed for comparison.
View on GitHubAdd to my skills
Verified commit 02f3158379a7ec355d73c92bf97d432fafb2adc9
git clone --filter=blob:none --no-checkout https://github.com/openclaw/agent-skills.git .hotskills/openclaw-agent-skills && git -C .hotskills/openclaw-agent-skills checkout --detach 02f3158379a7ec355d73c92bf97d432fafb2adc9
# Copy each selected skill directory from .hotskills/openclaw-agent-skills into .agents/skills/<skill-name>/1.1kGitHub stars
2stars in 7 days
9skills in this repository
59commits in 30 days
Heat
3.3- Star growth, last 7 daysAhead of 52% of tracked repositories
- Star growth, last 24 hoursAhead of 3% of tracked repositories
- Rank movement, last 7 daysAhead of 6% of tracked repositories
- Commits, last 30 daysAhead of 91% of tracked repositories
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekAhead of 0% of tracked repositories
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
Individual skills in this repository
- agent-transcript
skills/agent-transcript - autoreview
skills/autoreview - beam
skills/beam - behavior-validator
skills/behavior-validator - crabbox
skills/crabbox - handoff
skills/handoff - readme-standard
skills/readme-standard - session-viewer
skills/session-viewer - team-handoff
skills/team-handoff
How it works
agent-transcript
When your agent uses it
Requested GitHub PR/issue agent transcripts: redact, trim, preview, and insert safely.
What it loads into context
Frontmatter
28 tokensAlways available to the agent
SKILL.md
887 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Prepare Locally
- Preview And Insert
- Validate Helper Changes
Scripts executed separately
package.jsonscripts/agent-transcriptscripts/agent-transcript.test.mjs
Files
SKILL.mdcore4,222 bytesSKILL.mdcore4,222 bytesSKILL.mdcore4,222 bytesSKILL.mdcore4,222 bytespackage.jsonruns23 bytesscripts/agent-transcriptruns34,195 bytesscripts/agent-transcript.test.mjsruns18,190 bytes
Read SKILL.md
# Agent Transcript
Use only when the user explicitly requests a transcript or preview. Omit by
default; never offer one or ask whether to include one during ordinary PR work.
A preview request alone does not authorize publication.
For a session hosted at `*.openclaw.ai`, use native session sharing when sharing
is requested; export a separate transcript only when the user explicitly asks
for that copy. Identify hosting from the current session URL, not a repository
URL or deployment/test target. Do not offer separate exports.
## Prepare Locally
Default file discovery/rendering reads local Codex, Claude, Pi, and OpenClawautoreview
When your agent uses it
Structured code review when explicitly requested, preferring OpenAI/Codex before Claude.
What it loads into context
Frontmatter
25 tokensAlways available to the agent
SKILL.md
3,485 tokensWhen the skill is activated
Reference documents
8,294 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Hosted review requests
- Run
- Context and severity
- Engines
- Image review
- Runtime boundaries
- Diagnostics and results
Scripts executed separately
../../scripts/install-skills../../scripts/install-skills../../scripts/install-skills../../scripts/install-skillsscripts/autoreviewscripts/autoreview.ps1scripts/autoreview_test.pyscripts/test-review-harnessscripts/test-review-harness.ps1scripts/test-review-harness.pytests/fixtures/typescript-benign-config-path-references.tstests/fixtures/typescript-benign-references.tstests/fixtures/typescript-sensitive-literals.tstests/test_autoreview_hardening.pytests/test_codex_inference_route.pytests/test_codex_sandbox.pytests/test_engine_stage.pytests/test_git_boundary.pytests/test_git_filter_collection.pytests/test_git_line_endings.pytests/test_gitlinks.pytests/test_native_handoff.pytests/test_openclaw_exec.pytests/test_output_path_interpretation.pytests/test_output_readiness.pytests/test_prompt_budget.pytests/test_review_batches.pytests/test_review_harness.pytests/test_terminal_report_authority.py
Files
../../scripts/install-skillsruns3,942 bytes../../scripts/install-skillsruns3,942 bytes../../scripts/install-skillsruns3,942 bytes../../scripts/install-skillsruns3,942 bytesAGENTS.mddoc476 bytesSKILL.mdcore16,593 bytesSKILL.mdcore16,593 bytesSKILL.mdcore16,593 bytesSKILL.mdcore16,593 bytesSKILL.mdcore16,593 bytesSKILL.mdcore16,593 bytesSKILL.mdcore16,593 bytesSKILL.mdcore16,593 bytesSKILL.mdcore16,593 bytesreferences/diagnostics-and-results.mddoc7,278 bytesreferences/engines.mddoc8,395 bytesreferences/git-and-context.mddoc11,341 bytesreferences/images.mddoc1,478 bytesreferences/openclaw.mddoc9,936 bytesreferences/repository-entrypoint.mddoc1,397 bytesscripts/autoreviewruns380,121 bytesscripts/autoreview.ps1runs1,124 bytesscripts/autoreview_test.pyruns168,500 bytesscripts/test-review-harnessruns586 bytesscripts/test-review-harness.ps1runs1,660 bytesscripts/test-review-harness.pyruns11,034 bytestests/fixtures/swift-benign-status-literals.swiftasset1,204 bytestests/fixtures/typescript-benign-config-path-references.tsruns1,140 bytestests/fixtures/typescript-benign-references.tsruns2,092 bytestests/fixtures/typescript-sensitive-literals.tsruns714 bytestests/test_autoreview_hardening.pyruns449,057 bytestests/test_codex_inference_route.pyruns39,170 bytestests/test_codex_sandbox.pyruns4,611 bytestests/test_engine_stage.pyruns55,257 bytestests/test_git_boundary.pyruns28,868 bytestests/test_git_filter_collection.pyruns27,557 bytestests/test_git_line_endings.pyruns6,781 bytestests/test_gitlinks.pyruns6,036 bytestests/test_native_handoff.pyruns25,513 bytestests/test_openclaw_exec.pyruns14,036 bytestests/test_output_path_interpretation.pyruns34,157 bytestests/test_output_readiness.pyruns19,028 bytestests/test_prompt_budget.pyruns9,009 bytestests/test_review_batches.pyruns17,792 bytestests/test_review_harness.pyruns10,939 bytestests/test_terminal_report_authority.pyruns14,144 bytes
Read SKILL.md
# Auto Review
Run an independent review when the user or owning workflow asks. This is code
review, not Guardian approval routing. Supply target, context, and severity;
let the reviewer choose the analysis. Verify findings before acting.
## Hosted review requests
ClawSweeper's service policy owns automatic review admission, including first
reviews of newer maintainer PRs. The rules here govern agent-issued requests. Request
`@clawsweeper review` only when the maintainer asks for it or the owning workflow
specifically requires ClawSweeper, after the work and validation are complete.
A generic independent-review requirement does not require a hosted bot review.
Check for an existing queued or running review before requesting one. Do notbeam
When your agent uses it
Share a redacted coding session or hand its logical conversation to an authenticated OpenClaw Gateway.
What it loads into context
Frontmatter
26 tokensAlways available to the agent
SKILL.md
1,881 tokensWhen the skill is activated
Reference documents
2,562 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Contract
- Snapshot
- Live logical handoff
- Live Hooks
- Development
Scripts executed separately
../../scripts/validate-skillspackage.jsonscripts/beamscripts/beam-handoff.jsscripts/beam-handoff.test.mjsscripts/beam-session.jsscripts/beam.test.mjs
Files
../../scripts/validate-skillsruns2,330 bytesREADME.mddoc12,007 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytesSKILL.mdcore8,872 bytespackage.jsonruns23 bytesreferences/claude-code-hooks.jsonasset588 bytesreferences/codex-hooks.tomlasset252 bytesscripts/beamruns20,391 bytesscripts/beam-handoff.jsruns8,683 bytesscripts/beam-handoff.test.mjsruns7,859 bytesscripts/beam-session.jsruns30,719 bytesscripts/beam.test.mjsruns62,030 bytes
Read SKILL.md
# Beam
Use when the user explicitly asks to beam, publish, or share the current local coding session with an authenticated OpenClaw receiver.
## Contract
- Treat invoking this skill as approval for one snapshot upload to the named destination.
- Never upload raw JSONL, reasoning, system/developer prompts, tool output, environment values, credentials, browser state, cookies, or local paths.
- The helper is self-contained: it resolves and parses exact Claude Code or Codex transcripts, then uploads only locally redacted user/assistant messages and compact tool counts.
- Ordinary publishing shares a read-only snapshot. A separately requested `handoff` releases the source Beam identity and moves its logical conversation to Team. After handoff, use Beam's authenticated `read` and `continue` commands for subsequent work; do not resume independent source work or publish another transcript copy.
- Team owns one durable conversation after release. The source history imports once; reads, reconnects and continuations resolve that same conversation. Native provider runtime IDs need not survive. Do not connect a node, expose a terminal, transfer credentials or grant filesystem/tool access.
- Require HTTPS except for loopback development endpoints.
- Guests use their existing personal Cloudflare Access sign-in or `BEAM_ACCESS_TOKEN`; never request, share, or copy a Gateway token for guest uploads. `BEAM_AUTH_TOKEN` remains the ordinary operator Gateway-auth fallback, not a guest credential. Never print token values.
- Live synchronization is opt-in persistent behavior. Do not install hooks unless the user explicitly asks for live Beam updates.behavior-validator
When your agent uses it
Source-blind user behavior validation against a prewritten contract for apps, CLIs, APIs, and generated artifacts.
What it loads into context
Frontmatter
31 tokensAlways available to the agent
SKILL.md
743 tokensWhen the skill is activated
Reference documents
646 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Contract
- Isolation
- Workflow
- Finding Rules
- Final Report
Files
SKILL.mdcore3,757 bytesSKILL.mdcore3,757 bytesSKILL.mdcore3,757 bytesSKILL.mdcore3,757 bytesSKILL.mdcore3,757 bytesSKILL.mdcore3,757 bytesagents/openai.yamlasset232 bytesreferences/contract-template.mddoc1,416 bytesreferences/report-schema.mddoc1,387 bytes
Read SKILL.md
# Behavior Validator
Validate observable behavior without inspecting source. Use this as the black-box companion to code-aware review: `autoreview` judges the change bundle, while `behavior-validator` judges the running product, CLI, API, or generated artifact against a behavior contract.
## Contract
- Read the behavior contract first. If none exists, write a short one from the user request before testing. See `references/contract-template.md`.
- Stay source-blind. Do not inspect source files, diffs, tests, git history, implementation notes, build internals, or review bundles.
- Interact only through user-visible or operator-visible surfaces: browser, CLI, API, generated files, public logs, screenshots, accessibility trees, or documented runtime output.
- Treat implementation-looking evidence as contamination. If source access is required to continue, stop and report `blocked_source_required`.
- Report findings against contract clauses and observable steps, not code locations.
- Do not mark a workflow as passing until each relevant contract clause is pass, fail, blocked, or out of scope.
## Isolationcrabbox
When your agent uses it
Crabbox/Testbox remote proof: portable provider routing, untrusted isolation, Linux/macOS/Windows/WSL2, live E2E, diagnostics, cleanup.
What it loads into context
Frontmatter
43 tokensAlways available to the agent
SKILL.md
1,582 tokensWhen the skill is activated
Reference documents
2,079 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Repository Contract
- Authorization and Isolation
- Route First
- Preflight
- Trusted Testbox
- Specialized Proof and Diagnostics
Files
SKILL.mdcore7,006 bytesSKILL.mdcore7,006 bytesSKILL.mdcore7,006 bytesSKILL.mdcore7,006 bytesSKILL.mdcore7,006 bytesSKILL.mdcore7,006 bytesSKILL.mdcore7,006 bytesSKILL.mdcore7,006 bytesreferences/diagnostics-and-e2e.mddoc3,228 bytesreferences/providers-and-desktop.mddoc2,920 bytesreferences/untrusted-aws.mddoc1,860 bytes
Read SKILL.md
# Crabbox
- **PR CI = default broad proof.** Use the consumer repository's proof policy
for required checks, builds, and ready/merge gates. Run bounded local checks
only when source trust and host qualification permit them.
- **Required build unavailable:** remote capacity unavailable + local execution
unqualified permits an already-authorized draft with the exact missing build
and capacity gap recorded. Require successful exact-head CI covering that build
before ready or merge. A skipped draft job is not proof: use the consumer's
supported exact-head CI route. This changes proof timing, never publication
authority, source trust, credentials, owner approval, or merge gates.
- Box only for gaps in CI/local coverage: another OS/device, live providers/channels,
long E2E, heavy benchmarks. Acquire only with command ready + immediate grant.
- Queued: stop task-owned request; use PR CI or a qualified, trusted local scope.handoff
When your agent uses it
Clipboard-ready handoff prompt for another agent to investigate or continue a task.
What it loads into context
Frontmatter
23 tokensAlways available to the agent
SKILL.md
1,009 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Workflow
- Handoff Prompt Rules
- Prompt Template
- Clipboard
- Quality Bar
Files
SKILL.mdcore4,794 bytesSKILL.mdcore4,794 bytes
Read SKILL.md
# Handoff
Write a clipboard-ready prompt for another agent to investigate, discuss, or work
on a specific task.
Use when the user asks for `handoff <task>`, "write a handoff", "delegate this",
or wants a prompt for another agent.
## Workflow
1. Identify the task from the user text. If the user gives only a short label,
infer from the current repo, recent discussion, branch name, linked issue/PR,
docs, and obvious nearby context.
2. Gather enough context to write a useful handoff: repo/product identity,readme-standard
When your agent uses it
House README standard: structure, badge row, tone, per-archetype templates, and verification gates for steipete/openclaw repos.
What it loads into context
Frontmatter
38 tokensAlways available to the agent
SKILL.md
1,442 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- The spine
- Rules
- Badge row
- Per-archetype templates
- Verification gates (all mandatory)
Files
SKILL.mdcore5,861 bytes
Read SKILL.md
# README Standard
One structure for every public README in the steipete and openclaw orgs. Load
this skill before writing or reviewing a README. The reference implementation
is [`openclaw/fs-safe`](https://github.com/openclaw/fs-safe) — read its README
first if unsure what "good" looks like.
## The spine
Every README answers, in order, with no detours:
1. **What is this?** — one sentence a stranger understands.
2. **How do I use it?** — smallest real install + a quickstart that *proves the pitch*.
3. **Progressively more complex** — each section assumes the previous one; deepsession-viewer
When your agent uses it
Render Codex, Claude Code, OpenClaw, or Pi session JSONL transcripts as a searchable, shareable single-file HTML viewer.
What it loads into context
Frontmatter
37 tokensAlways available to the agent
SKILL.md
1,092 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Commands
- Where Sessions Live
- Development
Scripts executed separately
../../scripts/validate-skillspackage.jsonscripts/core/detect.tsscripts/core/jsonl.tsscripts/core/types.tsscripts/html.tsscripts/importers/claude.tsscripts/importers/codex.tsscripts/importers/pi-openclaw.tsscripts/open-browser.tsscripts/read-session.tsscripts/session-viewer.test.tsscripts/session-viewer.tsscripts/styles.ts
Files
../../scripts/validate-skillsruns2,330 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesSKILL.mdcore4,421 bytesagents/openai.yamlasset207 bytespackage.jsonruns23 bytesscripts/core/detect.tsruns1,066 bytesscripts/core/jsonl.tsruns7,658 bytesscripts/core/types.tsruns1,050 bytesscripts/html.tsruns38,119 bytesscripts/importers/claude.tsruns5,583 bytesscripts/importers/codex.tsruns8,187 bytesscripts/importers/pi-openclaw.tsruns7,800 bytesscripts/open-browser.tsruns435 bytesscripts/read-session.tsruns1,513 bytesscripts/session-viewer.test.tsruns34,604 bytesscripts/session-viewer.tsruns4,982 bytesscripts/styles.tsruns13,333 bytestsconfig.jsonasset276 bytes
Read SKILL.md
# Session Viewer
Use when asked to view, export, inspect, or share a Codex, Claude Code, OpenClaw, or Pi session transcript in a browser.
## Commands
Resolve `SESSION_VIEWER_SKILL_DIR` to the directory containing this `SKILL.md`.
Use that installed source for commands, independent of the current repository.
When the session path is not known and the `agent-transcript` skill is available, use it first to find the likely JSONL session:
Resolve `TRANSCRIPT_SKILL_DIR` from that skill's actual installation before running:
```bash
"$TRANSCRIPT_SKILL_DIR/scripts/agent-transcript" find \team-handoff
When your agent uses it
Hand local work to a shared OpenClaw Gateway: start a worktree session there as yourself in one request, seeded with a handoff, and get the session URL back.
What it loads into context
Frontmatter
45 tokensAlways available to the agent
SKILL.md
1,299 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Setup (once per machine)
- Use
- Payload
- Failure modes
- SSH operator fallback
- Don'ts
Scripts executed separately
scripts/team-handoff.sh
Files
SKILL.mdcore5,232 bytesSKILL.mdcore5,232 bytesSKILL.mdcore5,232 bytesSKILL.mdcore5,232 bytesSKILL.mdcore5,232 bytesSKILL.mdcore5,232 bytesSKILL.mdcore5,232 bytesscripts/team-handoff.shruns9,861 bytes
Read SKILL.md
# Team Handoff
Use when the user says "open a session on the team server for this", "hand this
off to <team agent>", or "summarize this for a new agent and start it on
<gateway>", and the target is a shared OpenClaw Gateway behind an identity-aware
proxy (Cloudflare Access).
One Gateway request, as the operator's own identity. No browser automation, no
SSH, no polling.
Resolve `HANDOFF_SKILL_DIR` to the directory containing this `SKILL.md`.
Invoke that installation without changing the consumer's working directory.
## Setup (once per machine)Skills included
- agent-transcript
- autoreview
- beam
- behavior-validator
- crabbox
- handoff
- readme-standard
- session-viewer
- team-handoff
Repository facts
- License
- MIT
- Created
- May 22, 2026
- Last pushed
- Nov 5, 2026
- Forks
- 117
- Open issues
- 3
- Project activity
- Active
Rank over the last 12 weeks
Now #818 · best #546 · down 131 in 30 days
- #803 on Nov 1
- #810 on Nov 2
- #815 on Nov 3
- #818 on Nov 4
- #817 on Nov 5
- #818 since Nov 6
60 earlier periods
- #529 on Aug 2
- #524 on Aug 7
- #518 on Aug 8
- #526 on Aug 9
- #544 on Aug 10
- #546 on Aug 12
- #547 from Aug 13 to Aug 14
- #531 on Aug 15
- #546 on Aug 16
- #563 on Aug 18
- #555 on Aug 19
- #564 on Aug 21
- #568 on Aug 23
- #586 on Aug 25
- #575 on Aug 26
- #596 on Aug 28
- #559 on Aug 29
- #554 on Aug 30
- #593 on Sep 1
- #583 on Sep 2
- #584 on Sep 3
- #571 on Sep 4
- #568 on Sep 5
- #579 on Sep 6
- #608 on Sep 8
- #596 on Sep 9
- #602 on Sep 10
- #594 on Sep 12
- #589 on Sep 13
- #604 on Sep 15
- #621 on Sep 18
- #610 on Sep 20
- #624 on Sep 21
- #640 on Sep 22
- #636 on Sep 23
- #609 on Sep 24
- #607 on Sep 25
- #605 on Sep 26
- #628 on Sep 27
- #633 on Sep 28
- #668 on Sep 29
- #649 on Sep 30
- #613 on Oct 3
- #647 on Oct 6
- #653 on Oct 7
- #687 on Oct 8
- #657 on Oct 10
- #671 on Oct 12
- #667 on Oct 13
- #682 on Oct 14
- #684 on Oct 16
- #665 on Oct 17
- #696 on Oct 19
- #704 on Oct 20
- #697 on Oct 23
- #782 on Oct 25
- #793 on Oct 28
- #797 on Oct 29
- #798 on Oct 30
- #801 on Oct 31
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 6, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 64 notes
skills/agent-transcript/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/agent-transcript/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/agent-transcript/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedscripts/install-skills:1Analysis incomplete: Referenced executable target unavailable; not analyzedscripts/install-skills:1Analysis incomplete: Referenced executable target unavailable; not analyzedscripts/install-skills:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/autoreview/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/autoreview/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/autoreview/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/autoreview/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/autoreview/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/autoreview/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/autoreview/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/autoreview/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/beam/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/beam/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/beam/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/beam/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/beam/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/beam/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 4 dangerous shell commandsin 4 files: autoreview/scripts/test-review-harness.py:56 autoreview/tests/test_output_readiness.py:23 session-viewer/scripts/session-viewer.test.ts:901 and 1 more
- 362 network referencesin 24 files: beam/scripts/beam.test.mjs:75 autoreview/tests/test_autoreview_hardening.py:5243 autoreview/tests/test_codex_inference_route.py:58 and 21 more
- 2 obfuscation signalsin 2 files: autoreview/scripts/autoreview_test.py:325 session-viewer/scripts/html.ts:141
- No instruction overrides
- 54 executable scriptsin 50 files: scripts/install-skills:1 scripts/validate-skills:1 agent-transcript/package.json:1 and 47 more
- 561 references to secretsin 27 files: autoreview/tests/test_autoreview_hardening.py:57 autoreview/scripts/autoreview:61 autoreview/scripts/autoreview_test.py:66 and 24 more
- No requests to vote in Hot
Show all 983 signals by file
scripts/install-skills
scripts/validate-skills
skills/agent-transcript/SKILL.md
- Access to secretsline 51
[Credential-related source omitted]
skills/agent-transcript/package.json
- Executable scriptline 1
Executable file
skills/agent-transcript/scripts/agent-transcript
- Executable scriptline 1
#!/usr/bin/env node - Access to secretsline 319
[Credential-related source omitted] - Access to secretsline 334
[Credential-related source omitted] - Network accessline 410
return "execute"; } if (/^(ssh|curl|wget|tailscale|nc )\b/.test(cmd)) return "network"; - Network accessline 411
} if (/^(ssh|curl|wget|tailscale|nc )\b/.test(cmd)) return "network"; return "execute"; - Network accessline 412
if (/^(ssh|curl|wget|tailscale|nc )\b/.test(cmd)) return "network";
skills/agent-transcript/scripts/agent-transcript.test.mjs
- Executable scriptline 1
Executable file - Network accessline 215
oversizedSession(dir); const prs = path.join(dir, "prs.json"); fs.writeFileSync(prs, JSON.stringify([{ title: "HEAD_READ_BOUND_MARKER", url: "https://example.com/pr/1" }])); - Network accessline 217
fs.writeFileSync(prs, JSON.stringify([{ title: "HEAD_READ_BOUND_MARKER", url: "https://example.com/pr/1" }])); - Network accessline 331
]); const prs = path.join(dir, "prs.json"); fs.writeFileSync(prs, JSON.stringify([{ title: "walk-cap-html-marker", url: "https://example.com/pr/1" }])); - Network accessline 333
fs.writeFileSync(prs, JSON.stringify([{ title: "walk-cap-html-marker", url: "https://example.com/pr/1" }])); - Network accessline 354
fs.writeFileSync(path.join(dir, "z-not-session.txt"), "ignored"); const prs = path.join(empty, "prs.json"); fs.writeFileSync(prs, JSON.stringify([{ title: "exact-cap-marker", url: "https://example.com/pr/1" }])); - Network accessline 355
const prs = path.join(empty, "prs.json"); fs.writeFileSync(prs, JSON.stringify([{ title: "exact-cap-marker", url: "https://example.com/pr/1" }])); for (const root of [dir, path.join(dir, "a.jsonl")]) { - Network accessline 356
fs.writeFileSync(prs, JSON.stringify([{ title: "exact-cap-marker", url: "https://example.com/pr/1" }]));
skills/autoreview/SKILL.md
- Network accessline 203
Autoreview does not invoke an external secret scanner. Keep approved scanning outside it: reviewer findings occur after transmission. Adding a scanner requires an explicit maintainer decision; see [#240](https://github.com/openclaw/agent-sk - Network accessline 205
an explicit maintainer decision; see [#240](https://github.com/openclaw/agent-skills/pull/240).
skills/autoreview/references/engines.md
- Network accessline 56
See [GPT-6.1 Sol](https://developers.openai.com/api/docs/models/gpt-6.1-sol), - Network accessline 57
[GPT-6 Sol](https://developers.openai.com/api/docs/models/gpt-6-sol), and - Network accessline 58
[GPT-6 Luna](https://developers.openai.com/api/docs/models/gpt-6-luna) model docs - Network accessline 59
and [Codex reasoning modes](https://learn.chatgpt.com/docs/models#know-when-to-use-max-or-ultra). - Access to secretsline 110
[Credential-related source omitted]
skills/autoreview/references/openclaw.md
- Access to secretsline 35
[Credential-related source omitted]
skills/autoreview/references/repository-entrypoint.md
skills/autoreview/scripts/autoreview
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 61
[Credential-related source omitted] - Access to secretsline 66
[Credential-related source omitted] - Access to secretsline 80
[Credential-related source omitted] - Access to secretsline 323
[Credential-related source omitted] - Access to secretsline 324
[Credential-related source omitted] - Access to secretsline 326
[Credential-related source omitted] - Access to secretsline 327
[Credential-related source omitted] - Access to secretsline 328
[Credential-related source omitted] - Access to secretsline 330
[Credential-related source omitted] - Access to secretsline 332
[Credential-related source omitted] - Access to secretsline 333
[Credential-related source omitted] - Access to secretsline 334
[Credential-related source omitted] - Access to secretsline 335
[Credential-related source omitted] - Access to secretsline 336
[Credential-related source omitted] - Access to secretsline 338
[Credential-related source omitted] - Access to secretsline 339
[Credential-related source omitted] - Access to secretsline 340
[Credential-related source omitted] - Access to secretsline 341
[Credential-related source omitted] - Access to secretsline 342
[Credential-related source omitted] - Access to secretsline 343
[Credential-related source omitted] - Access to secretsline 344
[Credential-related source omitted] - Access to secretsline 345
[Credential-related source omitted] - Access to secretsline 348
[Credential-related source omitted] - Access to secretsline 349
[Credential-related source omitted] - Access to secretsline 350
[Credential-related source omitted] - Access to secretsline 351
[Credential-related source omitted] - Access to secretsline 352
[Credential-related source omitted] - Access to secretsline 353
[Credential-related source omitted] - Access to secretsline 354
[Credential-related source omitted] - Access to secretsline 355
[Credential-related source omitted] - Access to secretsline 358
[Credential-related source omitted] - Access to secretsline 392
[Credential-related source omitted] - Access to secretsline 576
[Credential-related source omitted] - Access to secretsline 578
[Credential-related source omitted] - Access to secretsline 580
[Credential-related source omitted] - Access to secretsline 622
[Credential-related source omitted] - Access to secretsline 624
[Credential-related source omitted] - Access to secretsline 712
[Credential-related source omitted] - Network accessline 795
return False try: candidate = value if "://" in value else f"http://{value}" - Network accessline 796
try: candidate = value if "://" in value else f"http://{value}" parsed = urllib.parse.urlsplit(candidate) - Network accessline 797
candidate = value if "://" in value else f"http://{value}" parsed = urllib.parse.urlsplit(candidate) port = parsed.port - Network accessline 828
for value in values: try: parsed = urllib.parse.urlsplit(value if "://" in value else f"http://{value}") - Network accessline 829
try: parsed = urllib.parse.urlsplit(value if "://" in value else f"http://{value}") if parsed.username is None: - Network accessline 830
parsed = urllib.parse.urlsplit(value if "://" in value else f"http://{value}") - Access to secretsline 908
[Credential-related source omitted] - Access to secretsline 1011
[Credential-related source omitted] - Access to secretsline 1013
[Credential-related source omitted] - Access to secretsline 1014
[Credential-related source omitted] - Access to secretsline 1020
[Credential-related source omitted] - Access to secretsline 1021
[Credential-related source omitted] - Access to secretsline 1022
[Credential-related source omitted] - Access to secretsline 1030
[Credential-related source omitted] - Access to secretsline 1031
[Credential-related source omitted] - Access to secretsline 1103
[Credential-related source omitted] - Access to secretsline 1117
[Credential-related source omitted] - Access to secretsline 1124
[Credential-related source omitted] - Access to secretsline 1129
[Credential-related source omitted] - Access to secretsline 1152
[Credential-related source omitted] - Access to secretsline 1162
[Credential-related source omitted] - Access to secretsline 1166
[Credential-related source omitted] - Access to secretsline 1171
[Credential-related source omitted] - Access to secretsline 1174
[Credential-related source omitted] - Access to secretsline 1178
[Credential-related source omitted] - Access to secretsline 1189
[Credential-related source omitted] - Access to secretsline 1274
[Credential-related source omitted] - Access to secretsline 2092
[Credential-related source omitted] - Access to secretsline 2094
[Credential-related source omitted] - Access to secretsline 2114
[Credential-related source omitted] - Access to secretsline 2116
[Credential-related source omitted] - Access to secretsline 2117
[Credential-related source omitted] - Access to secretsline 2124
[Credential-related source omitted] - Access to secretsline 2125
[Credential-related source omitted] - Access to secretsline 2139
[Credential-related source omitted] - Access to secretsline 2145
[Credential-related source omitted] - Access to secretsline 2194
[Credential-related source omitted] - Access to secretsline 2224
[Credential-related source omitted] - Access to secretsline 5060
[Credential-related source omitted] - Access to secretsline 5112
[Credential-related source omitted] - Access to secretsline 5534
[Credential-related source omitted] - Access to secretsline 5536
[Credential-related source omitted] - Access to secretsline 5652
[Credential-related source omitted] - Access to secretsline 5687
[Credential-related source omitted] - Access to secretsline 5827
[Credential-related source omitted] - Access to secretsline 7521
[Credential-related source omitted] - Access to secretsline 7544
[Credential-related source omitted] - Access to secretsline 7550
[Credential-related source omitted] - Access to secretsline 7553
[Credential-related source omitted] - Access to secretsline 7555
[Credential-related source omitted] - Access to secretsline 7571
[Credential-related source omitted] - Access to secretsline 7572
[Credential-related source omitted] - Access to secretsline 7573
[Credential-related source omitted] - Access to secretsline 7574
[Credential-related source omitted] - Access to secretsline 7579
[Credential-related source omitted] - Access to secretsline 7593
[Credential-related source omitted] - Access to secretsline 7605
[Credential-related source omitted] - Access to secretsline 7613
[Credential-related source omitted] - Access to secretsline 7770
[Credential-related source omitted] - Access to secretsline 7776
[Credential-related source omitted] - Access to secretsline 7843
[Credential-related source omitted] - Access to secretsline 7849
[Credential-related source omitted]
skills/autoreview/scripts/autoreview.ps1
- Executable scriptline 1
Executable file
skills/autoreview/scripts/autoreview_test.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 66
[Credential-related source omitted] - Access to secretsline 67
[Credential-related source omitted] - Access to secretsline 80
[Credential-related source omitted] - Access to secretsline 136
[Credential-related source omitted] - Possible obfuscationline 325
PNG = base64.b64decode( - Access to secretsline 554
[Credential-related source omitted] - Access to secretsline 566
[Credential-related source omitted] - Access to secretsline 589
[Credential-related source omitted] - Access to secretsline 602
[Credential-related source omitted] - Access to secretsline 1069
[Credential-related source omitted] - Access to secretsline 1105
[Credential-related source omitted] - Access to secretsline 1106
[Credential-related source omitted] - Access to secretsline 1130
[Credential-related source omitted] - Access to secretsline 1135
[Credential-related source omitted] - Network accessline 1214
[Credential-related source omitted] - Network accessline 1215
[Credential-related source omitted] - Access to secretsline 1215
[Credential-related source omitted] - Network accessline 1216
"AMP_URL": "https://attacker.invalid", - Access to secretsline 1224
[Credential-related source omitted] - Access to secretsline 1289
[Credential-related source omitted] - Access to secretsline 1745
[Credential-related source omitted] - Access to secretsline 1787
[Credential-related source omitted] - Access to secretsline 1837
[Credential-related source omitted] - Access to secretsline 1840
[Credential-related source omitted] - Access to secretsline 1846
[Credential-related source omitted] - Access to secretsline 1848
[Credential-related source omitted] - Access to secretsline 1855
[Credential-related source omitted] - Access to secretsline 1870
[Credential-related source omitted] - Access to secretsline 1887
[Credential-related source omitted] - Access to secretsline 1888
[Credential-related source omitted] - Access to secretsline 1897
[Credential-related source omitted] - Access to secretsline 1909
[Credential-related source omitted] - Access to secretsline 1926
[Credential-related source omitted] - Access to secretsline 1941
[Credential-related source omitted] - Access to secretsline 1979
[Credential-related source omitted] - Access to secretsline 1995
[Credential-related source omitted] - Access to secretsline 2021
[Credential-related source omitted] - Access to secretsline 2044
[Credential-related source omitted] - Access to secretsline 2052
[Credential-related source omitted] - Access to secretsline 2066
[Credential-related source omitted] - Access to secretsline 2067
[Credential-related source omitted] - Access to secretsline 2068
[Credential-related source omitted] - Access to secretsline 2069
[Credential-related source omitted] - Access to secretsline 2070
[Credential-related source omitted] - Access to secretsline 2077
[Credential-related source omitted] - Access to secretsline 2079
[Credential-related source omitted] - Access to secretsline 2096
[Credential-related source omitted] - Access to secretsline 2144
[Credential-related source omitted] - Access to secretsline 2198
[Credential-related source omitted] - Access to secretsline 2200
[Credential-related source omitted] - Access to secretsline 2244
[Credential-related source omitted] - Access to secretsline 2431
[Credential-related source omitted] - Network accessline 2439
def configure_provider(self, *, base_url: str = "https://api.openai.com/v1", extra: str = "") -> None: - Network accessline 2653
self.repo, [], self.failure, command_auth=False, )) self.configure_provider(base_url="http://example.invalid/v1") - Network accessline 2654
)) self.configure_provider(base_url="http://example.invalid/v1") self.assertIsNone(AUTOREVIEW.load_codex_auth_fallback_route( - Network accessline 2655
self.configure_provider(base_url="http://example.invalid/v1") - Access to secretsline 2683
[Credential-related source omitted] - Access to secretsline 2928
[Credential-related source omitted] - Access to secretsline 2931
[Credential-related source omitted] - Access to secretsline 2933
[Credential-related source omitted] - Network accessline 3024
["--preflight-output", str(self.block)], ["--preflight-repo", "owner/repo"], ["--mode", "local"], ["--mode", "commit"], ["--dry-run"], ["--preflight-repo", "https://github.com/owner/repo"], - Network accessline 3025
["--mode", "local"], ["--mode", "commit"], ["--dry-run"], ["--preflight-repo", "https://github.com/owner/repo"], ["--preflight-repo", "o/" + "x" * 255], - Network accessline 3026
["--preflight-repo", "https://github.com/owner/repo"], - Access to secretsline 3153
[Credential-related source omitted] - Access to secretsline 3154
[Credential-related source omitted]
skills/autoreview/scripts/test-review-harness
- Executable scriptline 1
#!/usr/bin/env bash
skills/autoreview/scripts/test-review-harness.ps1
- Executable scriptline 1
Executable file
skills/autoreview/scripts/test-review-harness.py
skills/autoreview/tests/fixtures/typescript-benign-config-path-references.ts
- Executable scriptline 1
Executable file
skills/autoreview/tests/fixtures/typescript-benign-references.ts
- Executable scriptline 1
Executable file
skills/autoreview/tests/fixtures/typescript-sensitive-literals.ts
- Executable scriptline 1
[Credential-related source omitted]
skills/autoreview/tests/test_autoreview_hardening.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 57
[Credential-related source omitted] - Access to secretsline 59
[Credential-related source omitted] - Access to secretsline 76
[Credential-related source omitted] - Access to secretsline 78
[Credential-related source omitted] - Access to secretsline 105
[Credential-related source omitted] - Access to secretsline 110
[Credential-related source omitted] - Access to secretsline 115
[Credential-related source omitted] - Access to secretsline 136
[Credential-related source omitted] - Access to secretsline 141
[Credential-related source omitted] - Access to secretsline 144
[Credential-related source omitted] - Access to secretsline 146
[Credential-related source omitted] - Access to secretsline 953
[Credential-related source omitted] - Access to secretsline 954
[Credential-related source omitted] - Access to secretsline 955
[Credential-related source omitted] - Access to secretsline 957
[Credential-related source omitted] - Access to secretsline 1530
[Credential-related source omitted] - Access to secretsline 1542
[Credential-related source omitted] - Access to secretsline 1586
[Credential-related source omitted] - Access to secretsline 1587
[Credential-related source omitted] - Access to secretsline 1589
[Credential-related source omitted] - Access to secretsline 1758
[Credential-related source omitted] - Access to secretsline 2501
[Credential-related source omitted] - Access to secretsline 2518
[Credential-related source omitted] - Access to secretsline 2758
[Credential-related source omitted] - Access to secretsline 2759
[Credential-related source omitted] - Access to secretsline 3033
[Credential-related source omitted] - Access to secretsline 3035
[Credential-related source omitted] - Access to secretsline 3140
[Credential-related source omitted] - Access to secretsline 3144
[Credential-related source omitted] - Access to secretsline 3150
[Credential-related source omitted] - Access to secretsline 3188
[Credential-related source omitted] - Access to secretsline 3248
[Credential-related source omitted] - Access to secretsline 3342
[Credential-related source omitted] - Access to secretsline 3345
[Credential-related source omitted] - Access to secretsline 3353
[Credential-related source omitted] - Access to secretsline 3673
[Credential-related source omitted] - Access to secretsline 3680
[Credential-related source omitted] - Access to secretsline 3707
[Credential-related source omitted] - Access to secretsline 3869
[Credential-related source omitted] - Access to secretsline 3892
[Credential-related source omitted] - Access to secretsline 3900
[Credential-related source omitted] - Access to secretsline 3905
[Credential-related source omitted] - Access to secretsline 3910
[Credential-related source omitted] - Access to secretsline 3940
[Credential-related source omitted] - Access to secretsline 3967
[Credential-related source omitted] - Access to secretsline 4873
[Credential-related source omitted] - Access to secretsline 4907
[Credential-related source omitted] - Access to secretsline 4909
[Credential-related source omitted] - Access to secretsline 4912
[Credential-related source omitted] - Access to secretsline 4923
[Credential-related source omitted] - Access to secretsline 5034
[Credential-related source omitted] - Access to secretsline 5038
[Credential-related source omitted] - Access to secretsline 5043
[Credential-related source omitted] - Access to secretsline 5061
[Credential-related source omitted] - Access to secretsline 5062
[Credential-related source omitted] - Access to secretsline 5063
[Credential-related source omitted] - Access to secretsline 5102
[Credential-related source omitted] - Access to secretsline 5103
[Credential-related source omitted] - Access to secretsline 5104
[Credential-related source omitted] - Access to secretsline 5105
[Credential-related source omitted] - Access to secretsline 5116
[Credential-related source omitted] - Access to secretsline 5123
[Credential-related source omitted] - Access to secretsline 5124
[Credential-related source omitted] - Network accessline 5243
safe_lines = ( 'url = f"ssh://{ssh_user}@git.example.invalid/org/repo.git"', 'url = "https://alice@github.com/example/repo"', - Network accessline 5244
'url = f"ssh://{ssh_user}@git.example.invalid/org/repo.git"', 'url = "https://alice@github.com/example/repo"', 'url = "https://username:@host/repo"', - Network accessline 5245
'url = "https://alice@github.com/example/repo"', - Network accessline 5246
'url = "https://username:@host/repo"', - Access to secretsline 5467
[Credential-related source omitted] - Network accessline 5468
[Credential-related source omitted] - Network accessline 5469
[Credential-related source omitted] - Access to secretsline 5469
[Credential-related source omitted] - Network accessline 5470
"KIMI_BASE_URL": "https://api.example.invalid", - Access to secretsline 5479
[Credential-related source omitted] - Access to secretsline 5494
[Credential-related source omitted] - Access to secretsline 5499
[Credential-related source omitted] - Access to secretsline 5509
[Credential-related source omitted] - Access to secretsline 5536
[Credential-related source omitted] - Access to secretsline 5538
[Credential-related source omitted] - Access to secretsline 5554
[Credential-related source omitted] - Access to secretsline 5574
[Credential-related source omitted] - Access to secretsline 5588
[Credential-related source omitted] - Access to secretsline 5643
[Credential-related source omitted] - Access to secretsline 5647
[Credential-related source omitted] - Access to secretsline 5648
[Credential-related source omitted] - Access to secretsline 5649
[Credential-related source omitted] - Access to secretsline 5650
[Credential-related source omitted] - Access to secretsline 5651
[Credential-related source omitted] - Access to secretsline 5652
[Credential-related source omitted] - Access to secretsline 5653
[Credential-related source omitted] - Access to secretsline 5654
[Credential-related source omitted] - Access to secretsline 5655
[Credential-related source omitted] - Access to secretsline 5656
[Credential-related source omitted] - Access to secretsline 5657
[Credential-related source omitted] - Access to secretsline 5658
[Credential-related source omitted] - Access to secretsline 5659
[Credential-related source omitted] - Access to secretsline 5660
[Credential-related source omitted] - Access to secretsline 5661
[Credential-related source omitted] - Access to secretsline 5662
[Credential-related source omitted] - Access to secretsline 5663
[Credential-related source omitted] - Access to secretsline 5664
[Credential-related source omitted] - Access to secretsline 5665
[Credential-related source omitted] - Access to secretsline 5666
[Credential-related source omitted] - Access to secretsline 5667
[Credential-related source omitted] - Access to secretsline 5668
[Credential-related source omitted] - Network accessline 5669
[Credential-related source omitted] - Access to secretsline 5669
[Credential-related source omitted] - Network accessline 5670
[Credential-related source omitted] - Access to secretsline 5670
[Credential-related source omitted] - Network accessline 5671
"https://bedrock.example.invalid" - Network accessline 5672
) os.environ["ANTHROPIC_VERTEX_BASE_URL"] = ( "https://vertex.example.invalid" - Network accessline 5673
[Credential-related source omitted] - Access to secretsline 5673
[Credential-related source omitted] - Network accessline 5674
"https://vertex.example.invalid" - Access to secretsline 5676
[Credential-related source omitted] - Access to secretsline 5677
[Credential-related source omitted] - Access to secretsline 5678
[Credential-related source omitted] - Access to secretsline 5681
[Credential-related source omitted] - Network accessline 5682
[Credential-related source omitted] - Access to secretsline 5682
[Credential-related source omitted] - Network accessline 5683
[Credential-related source omitted] - Access to secretsline 5683
[Credential-related source omitted] - Network accessline 5684
[Credential-related source omitted] - Access to secretsline 5684
[Credential-related source omitted] - Access to secretsline 5685
[Credential-related source omitted] - Access to secretsline 5686
[Credential-related source omitted] - Access to secretsline 5687
[Credential-related source omitted] - Access to secretsline 5688
[Credential-related source omitted] - Access to secretsline 5689
[Credential-related source omitted] - Network accessline 5714
self.assertNotIn("COPILOT_ALLOW_ALL", env) self.assertNotIn("GITHUB_TOKEN", env) self.assertEqual(env["HTTPS_PROXY"], "http://proxy.example.invalid:8080") - Network accessline 5715
self.assertNotIn("GITHUB_TOKEN", env) self.assertEqual(env["HTTPS_PROXY"], "http://proxy.example.invalid:8080") self.assertEqual(env["HTTP_PROXY"], "proxy.example.invalid:8080") - Network accessline 5716
self.assertEqual(env["HTTPS_PROXY"], "http://proxy.example.invalid:8080") - Access to secretsline 5742
[Credential-related source omitted] - Network accessline 5749
self.assertEqual( claude_env["ANTHROPIC_BEDROCK_BASE_URL"], "https://bedrock.example.invalid", - Network accessline 5750
claude_env["ANTHROPIC_BEDROCK_BASE_URL"], "https://bedrock.example.invalid", ) - Network accessline 5751
"https://bedrock.example.invalid", - Network accessline 5753
self.assertEqual( claude_env["ANTHROPIC_VERTEX_BASE_URL"], "https://vertex.example.invalid", - Network accessline 5754
claude_env["ANTHROPIC_VERTEX_BASE_URL"], "https://vertex.example.invalid", ) - Network accessline 5755
"https://vertex.example.invalid", - Access to secretsline 5764
[Credential-related source omitted] - Access to secretsline 5770
[Credential-related source omitted] - Access to secretsline 5771
[Credential-related source omitted] - Access to secretsline 6142
[Credential-related source omitted] - Network accessline 6269
def test_safe_proxy_url_accepts_credential_free_formats(self) -> None: for value in ( "http://proxy.example.invalid:8080", - Network accessline 6270
for value in ( "http://proxy.example.invalid:8080", "proxy.example.invalid:8080", - Network accessline 6271
"http://proxy.example.invalid:8080", - Network accessline 6273
"socks4://proxy.example.invalid", "socks4a://proxy.example.invalid", "http://[fe80::1%25en0]:8080", - Network accessline 6274
"socks4a://proxy.example.invalid", "http://[fe80::1%25en0]:8080", ): - Network accessline 6275
"http://[fe80::1%25en0]:8080", - Network accessline 6280
for value in ( "http://review-user:review-password@proxy.example.invalid:8080", - Network accessline 6281
"http://review-user:review-password@proxy.example.invalid:8080", - Access to secretsline 6289
[Credential-related source omitted] - Network accessline 6290
{ "HTTPS_PROXY": ( "http://review-user:review-password@proxy.example.invalid:bad" - Network accessline 6291
"HTTPS_PROXY": ( "http://review-user:review-password@proxy.example.invalid:bad" ) - Network accessline 6292
"http://review-user:review-password@proxy.example.invalid:bad" - Access to secretsline 6432
[Credential-related source omitted] - Access to secretsline 6436
[Credential-related source omitted] - Access to secretsline 6442
[Credential-related source omitted] - Access to secretsline 6443
[Credential-related source omitted] - Access to secretsline 6446
[Credential-related source omitted] - Access to secretsline 6451
[Credential-related source omitted] - Access to secretsline 6452
[Credential-related source omitted] - Access to secretsline 6453
[Credential-related source omitted] - Access to secretsline 6454
[Credential-related source omitted] - Access to secretsline 6455
[Credential-related source omitted] - Access to secretsline 6458
[Credential-related source omitted] - Access to secretsline 6461
[Credential-related source omitted] - Network accessline 6463
) os.environ["AWS_CONTAINER_CREDENTIALS_FULL_URI"] = ( "http://169.254.170.2/credentials" - Network accessline 6464
[Credential-related source omitted] - Access to secretsline 6464
[Credential-related source omitted] - Network accessline 6465
"http://169.254.170.2/credentials" - Access to secretsline 6467
[Credential-related source omitted] - Access to secretsline 6470
[Credential-related source omitted] - Access to secretsline 6471
[Credential-related source omitted] - Access to secretsline 6474
[Credential-related source omitted] - Access to secretsline 6475
[Credential-related source omitted] - Access to secretsline 6476
[Credential-related source omitted] - Access to secretsline 6477
[Credential-related source omitted] - Access to secretsline 6478
[Credential-related source omitted] - Access to secretsline 6479
[Credential-related source omitted] - Access to secretsline 6480
[Credential-related source omitted] - Access to secretsline 6481
[Credential-related source omitted] - Access to secretsline 6482
[Credential-related source omitted] - Access to secretsline 6483
[Credential-related source omitted] - Access to secretsline 6484
[Credential-related source omitted] - Access to secretsline 6485
[Credential-related source omitted] - Access to secretsline 6486
[Credential-related source omitted] - Access to secretsline 6487
[Credential-related source omitted] - Access to secretsline 6488
[Credential-related source omitted] - Access to secretsline 6489
[Credential-related source omitted] - Access to secretsline 6490
[Credential-related source omitted] - Access to secretsline 6491
[Credential-related source omitted] - Access to secretsline 6492
[Credential-related source omitted] - Access to secretsline 6493
[Credential-related source omitted] - Access to secretsline 6494
[Credential-related source omitted] - Access to secretsline 6495
[Credential-related source omitted] - Access to secretsline 6496
[Credential-related source omitted] - Access to secretsline 6497
[Credential-related source omitted] - Access to secretsline 6498
[Credential-related source omitted] - Access to secretsline 6499
[Credential-related source omitted] - Access to secretsline 6500
[Credential-related source omitted] - Access to secretsline 6511
[Credential-related source omitted] - Access to secretsline 6515
[Credential-related source omitted] - Access to secretsline 6525
[Credential-related source omitted] - Access to secretsline 6528
[Credential-related source omitted] - Access to secretsline 6529
[Credential-related source omitted] - Access to secretsline 6531
[Credential-related source omitted] - Access to secretsline 6540
[Credential-related source omitted] - Access to secretsline 6553
[Credential-related source omitted] - Access to secretsline 6554
[Credential-related source omitted] - Access to secretsline 6558
[Credential-related source omitted] - Access to secretsline 6563
[Credential-related source omitted] - Access to secretsline 6565
[Credential-related source omitted] - Access to secretsline 6566
[Credential-related source omitted] - Access to secretsline 6569
[Credential-related source omitted] - Access to secretsline 6573
[Credential-related source omitted] - Access to secretsline 6574
[Credential-related source omitted] - Access to secretsline 6575
[Credential-related source omitted] - Access to secretsline 6576
[Credential-related source omitted] - Access to secretsline 6580
[Credential-related source omitted] - Access to secretsline 6581
[Credential-related source omitted] - Access to secretsline 6584
[Credential-related source omitted] - Access to secretsline 6591
[Credential-related source omitted] - Access to secretsline 6592
[Credential-related source omitted] - Access to secretsline 6595
[Credential-related source omitted] - Access to secretsline 6602
[Credential-related source omitted] - Access to secretsline 6603
[Credential-related source omitted] - Access to secretsline 6624
[Credential-related source omitted] - Access to secretsline 6625
[Credential-related source omitted] - Access to secretsline 6628
[Credential-related source omitted] - Access to secretsline 6632
[Credential-related source omitted] - Access to secretsline 6633
[Credential-related source omitted] - Access to secretsline 6634
[Credential-related source omitted] - Access to secretsline 6635
[Credential-related source omitted] - Access to secretsline 6636
[Credential-related source omitted] - Access to secretsline 6637
[Credential-related source omitted] - Access to secretsline 6638
[Credential-related source omitted] - Access to secretsline 6650
[Credential-related source omitted] - Access to secretsline 6651
[Credential-related source omitted] - Access to secretsline 6654
[Credential-related source omitted] - Access to secretsline 6664
[Credential-related source omitted] - Access to secretsline 6667
[Credential-related source omitted] - Access to secretsline 6668
[Credential-related source omitted] - Access to secretsline 6671
[Credential-related source omitted] - Access to secretsline 6688
[Credential-related source omitted] - Access to secretsline 6713
[Credential-related source omitted] - Access to secretsline 6714
[Credential-related source omitted] - Access to secretsline 6717
[Credential-related source omitted] - Access to secretsline 6732
[Credential-related source omitted] - Access to secretsline 6740
[Credential-related source omitted] - Access to secretsline 6741
[Credential-related source omitted] - Access to secretsline 6746
[Credential-related source omitted] - Access to secretsline 6758
[Credential-related source omitted] - Access to secretsline 6780
[Credential-related source omitted] - Access to secretsline 6781
[Credential-related source omitted] - Access to secretsline 6784
[Credential-related source omitted] - Access to secretsline 6800
[Credential-related source omitted] - Access to secretsline 6809
[Credential-related source omitted] - Access to secretsline 6810
[Credential-related source omitted] - Access to secretsline 6813
[Credential-related source omitted] - Access to secretsline 6820
[Credential-related source omitted] - Access to secretsline 6831
[Credential-related source omitted] - Access to secretsline 6832
[Credential-related source omitted] - Access to secretsline 6835
[Credential-related source omitted] - Access to secretsline 6841
[Credential-related source omitted] - Access to secretsline 6851
[Credential-related source omitted] - Access to secretsline 6852
[Credential-related source omitted] - Access to secretsline 6878
[Credential-related source omitted] - Access to secretsline 6879
[Credential-related source omitted] - Access to secretsline 6960
[Credential-related source omitted] - Access to secretsline 6963
[Credential-related source omitted] - Access to secretsline 6967
[Credential-related source omitted] - Access to secretsline 7291
[Credential-related source omitted] - Access to secretsline 7296
[Credential-related source omitted] - Access to secretsline 7308
[Credential-related source omitted] - Access to secretsline 7664
[Credential-related source omitted] - Access to secretsline 7665
[Credential-related source omitted] - Access to secretsline 7698
[Credential-related source omitted] - Access to secretsline 7699
[Credential-related source omitted] - Access to secretsline 7750
[Credential-related source omitted] - Access to secretsline 7757
[Credential-related source omitted] - Access to secretsline 7855
[Credential-related source omitted] - Access to secretsline 7967
[Credential-related source omitted] - Access to secretsline 8006
[Credential-related source omitted] - Access to secretsline 8178
[Credential-related source omitted] - Access to secretsline 8219
[Credential-related source omitted] - Access to secretsline 8257
[Credential-related source omitted] - Access to secretsline 8300
[Credential-related source omitted] - Access to secretsline 8362
[Credential-related source omitted] - Access to secretsline 8406
[Credential-related source omitted] - Access to secretsline 8446
[Credential-related source omitted] - Network accessline 8480
def test_authenticated_proxy_urls_are_transport_not_openclaw_provenance(self): for value in ( "http://user:password@proxy.example.invalid:8080", - Network accessline 8481
for value in ( "http://user:password@proxy.example.invalid:8080", "https://user:password@[::1]:8443/", - Network accessline 8482
"http://user:password@proxy.example.invalid:8080", - Network accessline 8483
"https://user:password@[::1]:8443/", - Network accessline 8484
"socks5h://u:p%40ss%3Aword@proxy.example.invalid:1080", "user:password@proxy.example.invalid:8080", "http://user@proxy.example.invalid", - Network accessline 8485
"user:password@proxy.example.invalid:8080", "http://user@proxy.example.invalid", "http://:password@proxy.example.invalid", - Network accessline 8486
"http://user@proxy.example.invalid", - Network accessline 8487
"http://:password@proxy.example.invalid", - Network accessline 8488
"http://proxy.example.invalid:8080", - Network accessline 8495
def test_malformed_proxy_urls_still_fail_closed(self): for value in ( "", "http://", "file:///proxy", "http://host:0", "http://host:65536", - Network accessline 8496
for value in ( "", "http://", "file:///proxy", "http://host:0", "http://host:65536", "http://host:bad", "http://[::1", "http://host/path", "http://host?q=1", - Network accessline 8497
"", "http://", "file:///proxy", "http://host:0", "http://host:65536", - Network accessline 8498
"http://host:bad", "http://[::1", "http://host/path", "http://host?q=1", - Network accessline 8499
"http://host#fragment", " http://host", "http://host\n", "http://ho\tst", - Network accessline 8500
"http://user:p%0Ass@host", "http://user:p%00ss@host", "http://user:p%zz@host", - Network accessline 8501
"http://user:p@ss@host", "http://user:p\\ass@host", "http://ho st", - Network accessline 8502
"http://host%0a.example", "http://host%2f.example", - Network accessline 8510
repo = root / "repo" repo.mkdir() proxy = "http://fixture:transport-password@127.0.0.1:8080" - Network accessline 8511
repo.mkdir() proxy = "http://fixture:transport-password@127.0.0.1:8080" transport = {key: proxy for key in PROXY_KEYS} - Network accessline 8512
proxy = "http://fixture:transport-password@127.0.0.1:8080" - Access to secretsline 8518
[Credential-related source omitted] - Access to secretsline 8521
[Credential-related source omitted] - Access to secretsline 8524
[Credential-related source omitted] - Access to secretsline 8527
[Credential-related source omitted] - Access to secretsline 8531
[Credential-related source omitted] - Access to secretsline 8533
[Credential-related source omitted] - Access to secretsline 8553
[Credential-related source omitted] - Network accessline 8565
userinfo = f"{username}:{password}" encoded = urllib.parse.quote(password, safe="") proxy = f"http://{username}:{encoded}@127.0.0.1:8080" - Network accessline 8566
encoded = urllib.parse.quote(password, safe="") proxy = f"http://{username}:{encoded}@127.0.0.1:8080" basic = base64.b64encode(userinfo.encode()).decode() - Network accessline 8567
proxy = f"http://{username}:{encoded}@127.0.0.1:8080" - Access to secretsline 8575
[Credential-related source omitted] - Access to secretsline 8588
[Credential-related source omitted] - Access to secretsline 8589
[Credential-related source omitted] - Access to secretsline 8613
[Credential-related source omitted] - Access to secretsline 8653
[Credential-related source omitted] - Access to secretsline 8654
[Credential-related source omitted] - Access to secretsline 8656
[Credential-related source omitted] - Access to secretsline 8657
[Credential-related source omitted] - Access to secretsline 8658
[Credential-related source omitted] - Access to secretsline 8663
[Credential-related source omitted] - Access to secretsline 8672
[Credential-related source omitted] - Access to secretsline 8673
[Credential-related source omitted] - Network accessline 8697
def test_serialized_redaction_does_not_turn_short_passwords_into_json_syntax(self): with mock.patch.dict(os.environ, {"HTTPS_PROXY": "http://u:1@localhost:8080"}, clear=True): - Network accessline 8698
[Credential-related source omitted] - Access to secretsline 8698
[Credential-related source omitted] - Network accessline 8707
[Credential-related source omitted] - Network accessline 8708
[Credential-related source omitted] - Access to secretsline 8708
[Credential-related source omitted] - Network accessline 8709
"HTTPS_PROXY": f"http://u:{password}@localhost:8080", - Network accessline 8724
for suffix in ("", ":"): with self.subTest(suffix=suffix), mock.patch.dict(os.environ, { "HTTPS_PROXY": f"http://u%40name{suffix}@localhost:8080", - Network accessline 8725
[Credential-related source omitted] - Access to secretsline 8725
[Credential-related source omitted] - Network accessline 8726
"HTTPS_PROXY": f"http://u%40name{suffix}@localhost:8080", - Network accessline 8727
}, clear=True): diagnostic = f"proxy=http://u@name{suffix}@LOCALHOST:8080/; user u@name is configured" redacted = self.helper["redact_proxy_credentials"](diagnostic) - Network accessline 8728
diagnostic = f"proxy=http://u@name{suffix}@LOCALHOST:8080/; user u@name is configured" - Network accessline 8738
for suffix in ("", ":"): with self.subTest(suffix=suffix), mock.patch.dict(os.environ, { "HTTPS_PROXY": f"http://{encoded}{suffix}@localhost:8080", - Network accessline 8739
[Credential-related source omitted] - Access to secretsline 8739
[Credential-related source omitted] - Network accessline 8740
"HTTPS_PROXY": f"http://{encoded}{suffix}@localhost:8080", - Network accessline 8755
for suffix in ("", ":"): with self.subTest(username=username, suffix=suffix), mock.patch.dict(os.environ, { "HTTPS_PROXY": f"http://{username}{suffix}@localhost:8080", - Network accessline 8756
[Credential-related source omitted] - Access to secretsline 8756
[Credential-related source omitted] - Network accessline 8757
"HTTPS_PROXY": f"http://{username}{suffix}@localhost:8080", - Access to secretsline 8774
[Credential-related source omitted] - Access to secretsline 8789
[Credential-related source omitted]
skills/autoreview/tests/test_codex_inference_route.py
- Executable scriptline 1
Executable file - Network accessline 58
} self.provider = { "name": "Synthetic review API", "base_url": "https://api.openai.com/v1", - Network accessline 59
self.provider = { "name": "Synthetic review API", "base_url": "https://api.openai.com/v1", "wire_api": "responses", "requires_openai_auth": False, - Network accessline 60
"name": "Synthetic review API", "base_url": "https://api.openai.com/v1", - Access to secretsline 73
[Credential-related source omitted] - Network accessline 146
flags = observed["flags"] self.assertEqual(flags.get("model_provider"), '"review_api"') self.assertEqual(flags.get("model_providers.review_api.base_url"), '"https://api.openai.com/v1"') - Network accessline 147
self.assertEqual(flags.get("model_provider"), '"review_api"') self.assertEqual(flags.get("model_providers.review_api.base_url"), '"https://api.openai.com/v1"') self.assert_auth_command(observed, self.runtime_helper) - Network accessline 148
self.assertEqual(flags.get("model_providers.review_api.base_url"), '"https://api.openai.com/v1"') - Network accessline 185
def test_https_gateway_base_url_reaches_client_unchanged(self): for base_url in ( "https://gateway.example.invalid/v1", - Network accessline 186
for base_url in ( "https://gateway.example.invalid/v1", "https://gateway.example.invalid:8443/inference/v1/", - Network accessline 187
"https://gateway.example.invalid/v1", - Network accessline 188
"https://gateway.example.invalid:8443/inference/v1/", - Network accessline 189
"https://[::1]:8443/v1", - Network accessline 190
"https://gateway.example.invalid", - Network accessline 191
"HTTPS://Gateway.Example.Invalid/v1/%23responses", - Network accessline 209
def test_invalid_base_url_refuses_in_run_and_preflight(self): for base_url in ( "http://gateway.example.invalid/v1", "http://127.0.0.1/v1", - Network accessline 210
for base_url in ( "http://gateway.example.invalid/v1", "http://127.0.0.1/v1", "https://user:password@gateway.example.invalid/v1", - Network accessline 211
"http://gateway.example.invalid/v1", "http://127.0.0.1/v1", - Network accessline 212
"https://user:password@gateway.example.invalid/v1", - Network accessline 213
"https://user@gateway.example.invalid/v1", - Network accessline 214
"https://@gateway.example.invalid/v1", - Network accessline 215
"https://gateway.example.invalid/v1?key=synthetic", - Network accessline 216
"https://gateway.example.invalid/v1#fragment", - Network accessline 217
"https://gateway.example.invalid/v1?", "https://gateway.example.invalid/v1#", - Network accessline 218
"not-a-url", "", "//gateway.example.invalid/v1", "https:///v1", - Network accessline 219
"https://", "https://[invalid/v1", - Network accessline 220
"https://gateway.example.invalid:bad/v1", - Network accessline 221
"https://gateway.example.invalid:65536/v1", - Network accessline 222
"https://gateway.example.invalid:0/v1", - Network accessline 223
"https://gateway.example.invalid:/v1", - Network accessline 224
" https://gateway.example.invalid/v1", - Network accessline 225
"https://gateway.example.invalid/v1\n", - Network accessline 226
"https://gate way.example.invalid/v1", - Network accessline 227
"https://gateway.example.invalid\\other/v1", - Network accessline 228
"https://gateway.example.invalid/v1/%invalid", - Network accessline 229
"https://gate%20way.example.invalid/v1", - Network accessline 230
"https://gateway.example.invalid%2fother/v1", - Network accessline 297
self.config.update({ "model_provider": provider, "profile": "operator-profile", "openai_base_url": "https://example.invalid/operator", - Network accessline 298
"model_provider": provider, "profile": "operator-profile", "openai_base_url": "https://example.invalid/operator", "forced_login_method": "api", - Network accessline 299
"openai_base_url": "https://example.invalid/operator", - Network accessline 300
"forced_login_method": "api", }) self.provider["base_url"] = "https://example.invalid/custom" - Network accessline 301
}) self.provider["base_url"] = "https://example.invalid/custom" self.write_config() - Network accessline 302
self.provider["base_url"] = "https://example.invalid/custom" - Access to secretsline 307
[Credential-related source omitted] - Network accessline 383
for config in ( {**original, "profile": "another-route"}, {**original, "openai_base_url": "https://example.invalid/v1"}, - Network accessline 384
{**original, "profile": "another-route"}, {**original, "openai_base_url": "https://example.invalid/v1"}, ): - Network accessline 385
{**original, "openai_base_url": "https://example.invalid/v1"}, - Access to secretsline 525
[Credential-related source omitted] - Access to secretsline 570
[Credential-related source omitted] - Access to secretsline 606
[Credential-related source omitted] - Access to secretsline 646
[Credential-related source omitted]
skills/autoreview/tests/test_codex_sandbox.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/autoreview/tests/test_engine_stage.py
- Executable scriptline 1
Executable file - Access to secretsline 97
[Credential-related source omitted] - Access to secretsline 446
[Credential-related source omitted] - Access to secretsline 598
[Credential-related source omitted] - Access to secretsline 735
[Credential-related source omitted] - Access to secretsline 809
[Credential-related source omitted]
skills/autoreview/tests/test_git_boundary.py
- Executable scriptline 1
Executable file - Access to secretsline 40
[Credential-related source omitted] - Access to secretsline 41
[Credential-related source omitted] - Access to secretsline 59
[Credential-related source omitted] - Access to secretsline 62
[Credential-related source omitted] - Access to secretsline 63
[Credential-related source omitted] - Access to secretsline 146
[Credential-related source omitted] - Access to secretsline 177
[Credential-related source omitted] - Access to secretsline 214
[Credential-related source omitted] - Access to secretsline 234
[Credential-related source omitted] - Access to secretsline 235
[Credential-related source omitted] - Access to secretsline 238
[Credential-related source omitted] - Access to secretsline 239
[Credential-related source omitted] - Access to secretsline 288
[Credential-related source omitted] - Access to secretsline 325
[Credential-related source omitted] - Network accessline 362
[Credential-related source omitted] - Access to secretsline 362
[Credential-related source omitted] - Network accessline 363
[Credential-related source omitted] - Access to secretsline 363
[Credential-related source omitted] - Network accessline 364
[Credential-related source omitted] - Access to secretsline 364
[Credential-related source omitted] - Access to secretsline 365
[Credential-related source omitted] - Access to secretsline 366
[Credential-related source omitted] - Access to secretsline 367
[Credential-related source omitted] - Access to secretsline 368
[Credential-related source omitted] - Access to secretsline 369
[Credential-related source omitted] - Access to secretsline 370
[Credential-related source omitted] - Access to secretsline 375
[Credential-related source omitted] - Network accessline 377
[Credential-related source omitted] - Network accessline 378
[Credential-related source omitted] - Network accessline 379
[Credential-related source omitted] - Access to secretsline 390
[Credential-related source omitted] - Access to secretsline 415
[Credential-related source omitted] - Access to secretsline 428
[Credential-related source omitted] - Access to secretsline 437
[Credential-related source omitted] - Access to secretsline 453
[Credential-related source omitted] - Access to secretsline 454
[Credential-related source omitted] - Access to secretsline 465
[Credential-related source omitted] - Access to secretsline 481
[Credential-related source omitted] - Access to secretsline 485
[Credential-related source omitted] - Access to secretsline 491
[Credential-related source omitted] - Access to secretsline 507
[Credential-related source omitted] - Access to secretsline 511
[Credential-related source omitted]
skills/autoreview/tests/test_git_filter_collection.py
skills/autoreview/tests/test_git_line_endings.py
- Executable scriptline 1
Executable file - Access to secretsline 39
[Credential-related source omitted] - Access to secretsline 88
[Credential-related source omitted] - Access to secretsline 94
[Credential-related source omitted] - Access to secretsline 95
[Credential-related source omitted] - Access to secretsline 105
[Credential-related source omitted] - Access to secretsline 106
[Credential-related source omitted] - Access to secretsline 148
[Credential-related source omitted]
skills/autoreview/tests/test_gitlinks.py
- Executable scriptline 1
Executable file - Network accessline 23
(repo / '.gitmodules').write_text( '[submodule "different-name"]\n path = vendor/dependency\n' ' url = https://example.invalid/old.git\n') - Network accessline 24
'[submodule "different-name"]\n path = vendor/dependency\n' ' url = https://example.invalid/old.git\n') git(repo, 'add', '.gitmodules') - Network accessline 25
' url = https://example.invalid/old.git\n') - Network accessline 36
(repo / '.gitmodules').write_text( '[submodule "different-name"]\n path = vendor/dependency\n' ' url = https://example.invalid/new.git\n') - Network accessline 37
'[submodule "different-name"]\n path = vendor/dependency\n' ' url = https://example.invalid/new.git\n') git(repo, 'add', '.gitmodules') - Network accessline 38
' url = https://example.invalid/new.git\n') - Network accessline 47
(repo / '.gitmodules').write_text('[invalid working tree\n') git(repo, 'config', 'submodule.different-name.url', 'https://wrong.invalid') - Network accessline 48
git(repo, 'config', 'submodule.different-name.url', 'https://wrong.invalid') - Network accessline 51
self.assertIn(old, bundle) self.assertIn(base, bundle) self.assertIn('https://example.invalid/old.git', bundle) - Network accessline 52
self.assertIn(base, bundle) self.assertIn('https://example.invalid/old.git', bundle) self.assertIn('https://example.invalid/new.git', bundle) - Network accessline 53
self.assertIn('https://example.invalid/old.git', bundle) - Network accessline 54
self.assertIn('https://example.invalid/new.git', bundle)
skills/autoreview/tests/test_native_handoff.py
skills/autoreview/tests/test_openclaw_exec.py
- Executable scriptline 1
Executable file - Access to secretsline 36
[Credential-related source omitted] - Access to secretsline 37
[Credential-related source omitted] - Access to secretsline 44
[Credential-related source omitted] - Access to secretsline 47
[Credential-related source omitted] - Access to secretsline 70
[Credential-related source omitted] - Access to secretsline 71
[Credential-related source omitted] - Access to secretsline 72
[Credential-related source omitted] - Access to secretsline 73
[Credential-related source omitted] - Access to secretsline 74
[Credential-related source omitted] - Access to secretsline 75
[Credential-related source omitted] - Access to secretsline 76
[Credential-related source omitted] - Access to secretsline 78
[Credential-related source omitted] - Access to secretsline 95
[Credential-related source omitted] - Access to secretsline 212
[Credential-related source omitted]
skills/autoreview/tests/test_output_path_interpretation.py
- Executable scriptline 1
Executable file - Access to secretsline 26
[Credential-related source omitted] - Access to secretsline 29
[Credential-related source omitted] - Access to secretsline 37
[Credential-related source omitted] - Access to secretsline 564
[Credential-related source omitted] - Access to secretsline 565
[Credential-related source omitted]
skills/autoreview/tests/test_output_readiness.py
skills/autoreview/tests/test_prompt_budget.py
skills/autoreview/tests/test_review_batches.py
- Executable scriptline 1
Executable file - Access to secretsline 25
[Credential-related source omitted] - Access to secretsline 28
[Credential-related source omitted] - Access to secretsline 30
[Credential-related source omitted] - Access to secretsline 171
[Credential-related source omitted] - Access to secretsline 172
[Credential-related source omitted] - Access to secretsline 195
[Credential-related source omitted]
skills/autoreview/tests/test_review_harness.py
skills/autoreview/tests/test_terminal_report_authority.py
- Executable scriptline 1
Executable file
skills/beam/README.md
- Network accessline 56
export BEAM_SKILL_DIR="${AGENTS_HOME:-$HOME/.agents}/skills/beam" export BEAM_ENDPOINT="https://gateway.example.com/api/v1/beam/sessions" - Network accessline 57
export BEAM_ENDPOINT="https://gateway.example.com/api/v1/beam/sessions" - Network accessline 80
Beamed session: https://gateway.example.com/beam/fix-upload-flow-0123456789ab - Network accessline 87
Beam upload succeeded: https://gateway.example.com/beam/fix-upload-flow-0123456789ab - Network accessline 95
A Gateway mounted below a base path returns that same base path, such as `https://gateway.example.com/openclaw/beam/fix-upload-flow-0123456789ab`. - Network accessline 96
`https://gateway.example.com/openclaw/beam/fix-upload-flow-0123456789ab`. - Network accessline 116
node "$BEAM_SKILL_DIR/scripts/beam" publish \ --endpoint http://127.0.0.1:9/api/v1/beam/sessions \ - Network accessline 117
--endpoint http://127.0.0.1:9/api/v1/beam/sessions \ - Access to secretsline 132
[Credential-related source omitted] - Network accessline 148
Expired Access credentials can cause authentication failure. Sign in again outside hooks (for example, `cloudflared access login https://gateway.example.com` for the - Network accessline 149
hooks (for example, `cloudflared access login https://gateway.example.com` for the - Access to secretsline 150
[Credential-related source omitted] - Access to secretsline 161
[Credential-related source omitted] - Access to secretsline 164
[Credential-related source omitted] - Network accessline 262
OpenClaw plugin documentation: https://docs.openclaw.ai/plugins/beam - Network accessline 263
https://docs.openclaw.ai/plugins/beam
skills/beam/SKILL.md
- Access to secretsline 13
[Credential-related source omitted] - Access to secretsline 18
[Credential-related source omitted] - Network accessline 26
export BEAM_ENDPOINT="https://gateway.example.com/api/v1/beam/sessions" - Network accessline 66
On success, return only the Beam URL and a short disclosure summary: source harness, shared message count, whether older entries were truncated, and whether the beam is complete. The URL uses the endpoint-derived Control UI base path follow - Access to secretsline 73
[Credential-related source omitted]
skills/beam/package.json
- Executable scriptline 1
Executable file
skills/beam/scripts/beam
- Executable scriptline 1
#!/usr/bin/env node - Access to secretsline 29
[Credential-related source omitted] - Access to secretsline 30
[Credential-related source omitted] - Access to secretsline 32
[Credential-related source omitted] - Access to secretsline 350
[Credential-related source omitted] - Access to secretsline 354
[Credential-related source omitted] - Network accessline 385
} const auth = authContext(url, options.hookMode !== true); const response = await fetch(url, { - Network accessline 386
const auth = authContext(url, options.hookMode !== true); const response = await fetch(url, { method: "POST", - Network accessline 387
const response = await fetch(url, {
skills/beam/scripts/beam-handoff.js
- Executable scriptline 1
Executable file - Access to secretsline 19
[Credential-related source omitted] - Access to secretsline 43
[Credential-related source omitted] - Access to secretsline 122
[Credential-related source omitted] - Access to secretsline 123
[Credential-related source omitted] - Access to secretsline 125
[Credential-related source omitted]
skills/beam/scripts/beam-handoff.test.mjs
- Executable scriptline 1
Executable file - Network accessline 8
const endpoint = "https://gateway.example/api/v1/beam/sessions"; - Network accessline 10
const generation = "b".repeat(32); const payload = { beamId, items: [{ type: "userMessage", text: "Continue this work" }] }; const receipt = { beamId, url: "https://gateway.example/beam/aaaaaaaaaaaa", handoff: { id: generation, owner: "gate - Network accessline 12
const receipt = { beamId, url: "https://gateway.example/beam/aaaaaaaaaaaa", handoff: { id: generation, owner: "gateway", access: "owned" } };
skills/beam/scripts/beam-session.js
- Executable scriptline 1
Executable file - Access to secretsline 496
[Credential-related source omitted] - Access to secretsline 497
[Credential-related source omitted] - Access to secretsline 498
[Credential-related source omitted] - Access to secretsline 499
[Credential-related source omitted] - Access to secretsline 500
[Credential-related source omitted] - Access to secretsline 501
[Credential-related source omitted] - Access to secretsline 510
[Credential-related source omitted] - Access to secretsline 560
[Credential-related source omitted]
skills/beam/scripts/beam.test.mjs
- Executable scriptline 1
Executable file - Access to secretsline 36
[Credential-related source omitted] - Network accessline 75
t.after(() => server.close()); const address = server.address(); return `http://127.0.0.1:${address.port}${basePath}/api/v1/beam/sessions`; - Network accessline 76
const address = server.address(); return `http://127.0.0.1:${address.port}${basePath}/api/v1/beam/sessions`; } - Network accessline 77
return `http://127.0.0.1:${address.port}${basePath}/api/v1/beam/sessions`; - Network accessline 91
test("standalone redaction strips internal wrappers, credentials, and local paths", () => { const value = sanitizeVisibleText( `<system-reminder>private policy text</system-reminder>\n<environment_context>cwd=/workspace/private timezo - Network accessline 92
const value = sanitizeVisibleText( `<system-reminder>private policy text</system-reminder>\n<environment_context>cwd=/workspace/private timezone=secret</environment_context>\nUse /root, /customer-secret.db, /app/customers/acme, D:/src/p - Network accessline 93
[Credential-related source omitted] - Access to secretsline 93
[Credential-related source omitted] - Access to secretsline 107
[Credential-related source omitted] - Access to secretsline 124
[Credential-related source omitted] - Network accessline 136
[Credential-related source omitted] - Network accessline 137
[Credential-related source omitted] - Network accessline 138
[Credential-related source omitted] - Network accessline 163
test("standalone redaction inspects local paths inside network URL parameters", () => { const value = sanitizeVisibleText( "Open https://example.test/report?file=%252525252FUsers%252525252Falice%252525252Fprivate#cwd=%2Ftmp%2Fwork and - Network accessline 164
const value = sanitizeVisibleText( "Open https://example.test/report?file=%252525252FUsers%252525252Falice%252525252Fprivate#cwd=%2Ftmp%2Fwork and https://example.test/#/Users/alice/a=b?view=1 and https://example.test/open?note=see%20%2 - Network accessline 165
"Open https://example.test/report?file=%252525252FUsers%252525252Falice%252525252Fprivate#cwd=%2Ftmp%2Fwork and https://example.test/#/Users/alice/a=b?view=1 and https://example.test/open?note=see%20%2FUsers%2Falice%2Fprivate&redirect=https - Network accessline 167
assert.equal( value, "Open https://example.test/report?file=[LOCAL_PATH]#cwd=[LOCAL_PATH] and https://example.test/#[LOCAL_PATH] and https://example.test/open?note=[LOCAL_PATH]&redirect=[LOCAL_PATH] and https://example.test/?files=[ - Network accessline 168
value, "Open https://example.test/report?file=[LOCAL_PATH]#cwd=[LOCAL_PATH] and https://example.test/#[LOCAL_PATH] and https://example.test/open?note=[LOCAL_PATH]&redirect=[LOCAL_PATH] and https://example.test/?files=[LOCAL_PATH] and ht - Network accessline 169
"Open https://example.test/report?file=[LOCAL_PATH]#cwd=[LOCAL_PATH] and https://example.test/#[LOCAL_PATH] and https://example.test/open?note=[LOCAL_PATH]&redirect=[LOCAL_PATH] and https://example.test/?files=[LOCAL_PATH] and https://examp - Network accessline 175
for (let index = 0; index < 10; index++) deeplyEncoded = encodeURIComponent(deeplyEncoded); const value = sanitizeVisibleText( `Open https://example.test/?%2FUsers%2Falice%2Fprivate=1 and https://example.test/?broken=%FF%2FUsers%2Fali - Network accessline 176
const value = sanitizeVisibleText( `Open https://example.test/?%2FUsers%2Falice%2Fprivate=1 and https://example.test/?broken=%FF%2FUsers%2Falice and https://example.test/?malformed=%ZZ/Users/alice/private and https://example.test/?deep= - Network accessline 177
`Open https://example.test/?%2FUsers%2Falice%2Fprivate=1 and https://example.test/?broken=%FF%2FUsers%2Falice and https://example.test/?malformed=%ZZ/Users/alice/private and https://example.test/?deep=${deeplyEncoded} and https://example.te - Network accessline 179
assert.equal( value, "Open https://example.test/?[LOCAL_PATH] and https://example.test/?broken=[LOCAL_PATH] and https://example.test/?malformed=[LOCAL_PATH] and https://example.test/?deep=[LOCAL_PATH] and https://example.test/search - Network accessline 180
value, "Open https://example.test/?[LOCAL_PATH] and https://example.test/?broken=[LOCAL_PATH] and https://example.test/?malformed=[LOCAL_PATH] and https://example.test/?deep=[LOCAL_PATH] and https://example.test/search?q=100%25", ); - Network accessline 181
"Open https://example.test/?[LOCAL_PATH] and https://example.test/?broken=[LOCAL_PATH] and https://example.test/?malformed=[LOCAL_PATH] and https://example.test/?deep=[LOCAL_PATH] and https://example.test/search?q=100%25", - Network accessline 526
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 527
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--session", - Network accessline 528
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 556
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 557
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--session", - Network accessline 558
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 579
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 580
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--session", - Network accessline 581
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 606
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 607
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--session", - Network accessline 608
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 627
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 628
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--session", - Network accessline 629
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 646
"publish", "--endpoint", "http://[::1]:9/api/v1/beam/sessions", - Network accessline 647
"--endpoint", "http://[::1]:9/api/v1/beam/sessions", "--session", - Network accessline 648
"http://[::1]:9/api/v1/beam/sessions", - Network accessline 670
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 671
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--session-id", - Network accessline 672
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 699
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 700
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--session-id", - Network accessline 701
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 732
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 733
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--cwd", - Network accessline 734
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 756
"publish", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 757
"--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--session", - Network accessline 758
"http://127.0.0.1:9/api/v1/beam/sessions", - Network accessline 770
const session = claudeSession(); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 771
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 772
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 792
]); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 793
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { stdin: JSON.stringify({ transcript_path: session, hook_event_name: "Stop" }) }, - Network accessline 794
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 803
const missing = path.join(tempDir(), "private", "missing.jsonl"); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 804
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 805
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 827
]); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 828
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 829
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 855
]); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 856
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 857
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 876
]); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 877
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 878
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 898
]); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 899
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 900
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 923
]); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 924
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 925
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 945
}; const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 946
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { stdin: JSON.stringify(hook) }, - Network accessline 947
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 963
writeJsonl(session, [{ type: "summary", summary: "hidden context" }]); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 964
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 965
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 983
const startedAt = Date.now(); const result = await run( ["hook", "--endpoint", "https://beam.invalid/api/v1/beam/sessions", "--quiet"], - Network accessline 984
const result = await run( ["hook", "--endpoint", "https://beam.invalid/api/v1/beam/sessions", "--quiet"], { - Network accessline 985
["hook", "--endpoint", "https://beam.invalid/api/v1/beam/sessions", "--quiet"], - Access to secretsline 987
[Credential-related source omitted] - Network accessline 1017
"publish", "--endpoint", "https://beam.invalid/api/v1/beam/sessions", - Network accessline 1018
"--endpoint", "https://beam.invalid/api/v1/beam/sessions", "--session", - Network accessline 1019
"https://beam.invalid/api/v1/beam/sessions", - Access to secretsline 1027
[Credential-related source omitted] - Access to secretsline 1028
[Credential-related source omitted] - Network accessline 1035
assert.equal(result.code, 1); assert.equal(fs.readFileSync(argsFile, "utf8").trim(), "access token --app=https://beam.invalid"); - Network accessline 1036
assert.equal(fs.readFileSync(argsFile, "utf8").trim(), "access token --app=https://beam.invalid"); - Network accessline 1047
]); const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 1048
const result = await run( ["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], { - Network accessline 1049
["hook", "--endpoint", "http://127.0.0.1:9/api/v1/beam/sessions", "--dry-run", "--quiet"], - Network accessline 1088
t.after(() => server.close()); const address = server.address(); const endpoint = `http://127.0.0.1:${address.port}/api/v1/beam/sessions`; - Network accessline 1090
const endpoint = `http://127.0.0.1:${address.port}/api/v1/beam/sessions`; - Access to secretsline 1094
[Credential-related source omitted] - Network accessline 1098
assert.match( result.stdout, new RegExp(`http://127\\.0\\.0\\.1:${address.port}/beam/[a-f0-9]{12}`), - Network accessline 1099
result.stdout, new RegExp(`http://127\\.0\\.0\\.1:${address.port}/beam/[a-f0-9]{12}`), ); - Network accessline 1100
new RegExp(`http://127\\.0\\.0\\.1:${address.port}/beam/[a-f0-9]{12}`), - Network accessline 1112
const requests = []; const endpoint = await beamReceiverEndpoint(t, (payload, request) => { requests.push(payload); - Network accessline 1113
const endpoint = await beamReceiverEndpoint(t, (payload, request) => { requests.push(payload); assert.equal(request.method, "POST"); - Network accessline 1114
requests.push(payload); - Access to secretsline 1125
[Credential-related source omitted] - Network accessline 1128
assert.equal(result.stderr, ""); const target = endpoint.replace(/\/api\/v1\/beam\/sessions$/, `/beam/upload-flow-${requests.at(-1).beamId.slice(0, 12)}`); - Network accessline 1129
const target = endpoint.replace(/\/api\/v1\/beam\/sessions$/, `/beam/upload-flow-${requests.at(-1).beamId.slice(0, 12)}`); assert.equal(result.stdout, canView === false - Network accessline 1130
`/beam/upload-flow-${requests.at(-1).beamId.slice(0, 12)}`); - Network accessline 1132
? `Beam upload succeeded: ${target}\nThis link is for authorized Team operators; upload-only access does not let you open it.\nSnapshot is read-only. To continue in Team, its authenticated original publisher must run beam handoff with the s - Network accessline 1133
: `Beamed session: ${target}\nSnapshot is read-only. To continue in Team, its authenticated original publisher must run beam handoff with the same endpoint and source transcript selector.\n`); assert.equal(requests.at(-1).version, 1); - Network accessline 1134
assert.equal(requests.at(-1).version, 1); - Network accessline 1135
assert.equal(Object.hasOwn(requests.at(-1), "canView"), false); - Network accessline 1136
assert.doesNotMatch(JSON.stringify(requests.at(-1)), /abcdefghijklmnopqrstuvwxyz123456|hidden compact summary|synthetic-personal-access/); - Network accessline 1137
} assert.equal(requests.length, 3); assert.equal(new Set(requests.map(({ beamId }) => beamId)).size, 1); - Network accessline 1138
assert.equal(requests.length, 3); assert.equal(new Set(requests.map(({ beamId }) => beamId)).size, 1); }); - Network accessline 1139
assert.equal(new Set(requests.map(({ beamId }) => beamId)).size, 1); - Network accessline 1190
const cases = [ [true, ({ beamId }) => `/team/chat/main?catalog=beam&host=gateway&thread=${beamId}`], [false, ({ beamId }) => `https://example.test/team/beam/${beamId.slice(0, 12)}`], - Network accessline 1191
[true, ({ beamId }) => `/team/chat/main?catalog=beam&host=gateway&thread=${beamId}`], [false, ({ beamId }) => `https://example.test/team/beam/${beamId.slice(0, 12)}`], [false, ({ beamId }) => `/beam/${beamId.slice(0, 12)}`], - Network accessline 1192
[false, ({ beamId }) => `https://example.test/team/beam/${beamId.slice(0, 12)}`], - Network accessline 1223
const source = http.createServer((_request, response) => { response.writeHead(307, { location: `http://127.0.0.1:${targetAddress.port}/stolen`, - Network accessline 1224
response.writeHead(307, { location: `http://127.0.0.1:${targetAddress.port}/stolen`, }); - Network accessline 1225
location: `http://127.0.0.1:${targetAddress.port}/stolen`, - Network accessline 1235
"publish", "--endpoint", `http://127.0.0.1:${sourceAddress.port}/api/v1/beam/sessions`, - Network accessline 1236
"--endpoint", `http://127.0.0.1:${sourceAddress.port}/api/v1/beam/sessions`, "--session", - Network accessline 1237
`http://127.0.0.1:${sourceAddress.port}/api/v1/beam/sessions`, - Access to secretsline 1241
[Credential-related source omitted] - Network accessline 1266
"publish", "--endpoint", `http://127.0.0.1:${address.port}/api/v1/beam/sessions`, - Network accessline 1267
"--endpoint", `http://127.0.0.1:${address.port}/api/v1/beam/sessions`, "--session", - Network accessline 1268
`http://127.0.0.1:${address.port}/api/v1/beam/sessions`, - Network accessline 1290
const result = await run( ["publish", "--endpoint", `http://127.0.0.1:${address.port}/api/v1/beam/sessions`, "--session", session], - Network accessline 1291
["publish", "--endpoint", `http://127.0.0.1:${address.port}/api/v1/beam/sessions`, "--session", session], - Access to secretsline 1292
[Credential-related source omitted] - Network accessline 1392
], ["wrong base path", ({ beamId }) => `/secret-prefix/beam/${beamId.slice(0, 12)}`], ["foreign origin", ({ beamId }) => `https://example.test/beam/${beamId.slice(0, 12)}`], - Network accessline 1393
["wrong base path", ({ beamId }) => `/secret-prefix/beam/${beamId.slice(0, 12)}`], ["foreign origin", ({ beamId }) => `https://example.test/beam/${beamId.slice(0, 12)}`], [ - Network accessline 1394
["foreign origin", ({ beamId }) => `https://example.test/beam/${beamId.slice(0, 12)}`], - Network accessline 1396
"credentials", ({ beamId }, request) => `http://user@${request.headers.host}/beam/${beamId.slice(0, 12)}`, - Network accessline 1397
({ beamId }, request) => `http://user@${request.headers.host}/beam/${beamId.slice(0, 12)}`, ], - Network accessline 1398
`http://user@${request.headers.host}/beam/${beamId.slice(0, 12)}`, - Network accessline 1491
for (status of [401, 403]) { const result = await run( ["publish", "--endpoint", `http://127.0.0.1:${address.port}/api/v1/beam/sessions`, "--session", session], - Network accessline 1492
[Credential-related source omitted] - Network accessline 1493
["publish", "--endpoint", `http://127.0.0.1:${address.port}/api/v1/beam/sessions`, "--session", session], - Access to secretsline 1494
[Credential-related source omitted]
skills/behavior-validator/references/report-schema.md
skills/crabbox/references/providers-and-desktop.md
- Network accessline 77
"$CRABBOX" warmup --desktop --browser --keep "$CRABBOX" desktop launch --id <id> \ --browser --url https://example.com --webvnc --open --take-control - Network accessline 78
"$CRABBOX" desktop launch --id <id> --browser --url https://example.com --webvnc --open --take-control - Network accessline 79
--browser --url https://example.com --webvnc --open --take-control
skills/crabbox/references/untrusted-aws.md
- Access to secretsline 16
[Credential-related source omitted]
skills/readme-standard/SKILL.md
- Network accessline 8
One structure for every public README in the steipete and openclaw orgs. Load this skill before writing or reviewing a README. The reference implementation is [`openclaw/fs-safe`](https://github.com/openclaw/fs-safe) — read its README - Network accessline 9
this skill before writing or reviewing a README. The reference implementation is [`openclaw/fs-safe`](https://github.com/openclaw/fs-safe) — read its README first if unsure what "good" looks like. - Network accessline 10
is [`openclaw/fs-safe`](https://github.com/openclaw/fs-safe) — read its README - Network accessline 70
[](https://github.com/OWNER/REPO/actions/workflows/ci.yml) - Network accessline 75
- **npm**: `https://img.shields.io/npm/v/PKG?style=flat-square` → npm page - Network accessline 76
- **GitHub release** (Go/Swift binaries): `https://img.shields.io/github/v/release/OWNER/REPO?style=flat-square` - Network accessline 78
`badge/platforms-...` or `badge/Swift-6.x-...` is acceptable for facts that only change with a commit (platforms, language version, min OS). - **License**: `https://img.shields.io/github/license/OWNER/REPO?style=flat-square` - Network accessline 79
only change with a commit (platforms, language version, min OS). - **License**: `https://img.shields.io/github/license/OWNER/REPO?style=flat-square` - **Homebrew**: static badge linking the tap, when a formula/cask exists. - Network accessline 80
- **License**: `https://img.shields.io/github/license/OWNER/REPO?style=flat-square`
skills/session-viewer/SKILL.md
- Network accessline 71
The viewer requires a supported JSONL transcript, not a SQLite database or session-list JSON. Use OpenClaw's native session view when no compatible JSONL export is available. See the [OpenClaw sessions reference](https://docs.openclaw.ai/cl - Network accessline 73
See the [OpenClaw sessions reference](https://docs.openclaw.ai/cli/sessions).
skills/session-viewer/package.json
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/core/detect.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/core/jsonl.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/core/types.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/html.ts
skills/session-viewer/scripts/importers/claude.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/importers/codex.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/importers/pi-openclaw.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/open-browser.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/read-session.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/session-viewer.test.ts
- Executable scriptline 1
Executable file - Network accessline 642
role: "user", content: "", MediaUrls: ["https://example.com/photo.png"], - Network accessline 643
content: "", MediaUrls: ["https://example.com/photo.png"], MediaUrl: "https://example.com/photo.png", - Network accessline 644
MediaUrls: ["https://example.com/photo.png"], - Network accessline 645
MediaUrl: "https://example.com/photo.png", - Network accessline 652
assert.equal(event?.text, ""); assert.equal(event?.images?.length, 1); assert.equal(event?.images?.[0]?.src, "https://example.com/photo.png"); - Network accessline 653
assert.equal(event?.images?.length, 1); assert.equal(event?.images?.[0]?.src, "https://example.com/photo.png"); }); - Network accessline 654
assert.equal(event?.images?.[0]?.src, "https://example.com/photo.png"); - Network accessline 669
content: "", MediaPaths: ["", "/tmp/photo.png"], MediaUrls: ["https://cdn.example/audio.mp3", "/tmp/photo.png"], - Network accessline 670
MediaPaths: ["", "/tmp/photo.png"], MediaUrls: ["https://cdn.example/audio.mp3", "/tmp/photo.png"], MediaTypes: ["audio/mpeg", "image/png"], - Network accessline 671
MediaUrls: ["https://cdn.example/audio.mp3", "/tmp/photo.png"], - Dangerous shell operationline 901
runInNewContext(script, {
skills/session-viewer/scripts/session-viewer.ts
- Executable scriptline 1
Executable file
skills/session-viewer/scripts/styles.ts
- Executable scriptline 1
Executable file - Network accessline 130
cursor: pointer; appearance: none; background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%23999' stroke-width='2.5' stroke-linecap='round' stro - Network accessline 131
appearance: none; background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%23999' stroke-width='2.5' stroke-linecap='round' stroke-linejoin='round' - Network accessline 132
background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%23999' stroke-width='2.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline point
skills/team-handoff/SKILL.md
skills/team-handoff/scripts/team-handoff.sh
- Executable scriptline 1
#!/usr/bin/env bash - Network accessline 54
ws_url() { printf '%s' "$URL" | sed -e 's#^https://#wss://#' -e 's#^http://#ws://#' - Network accessline 55
printf '%s' "$URL" | sed -e 's#^https://#wss://#' -e 's#^http://#ws://#' - Access to secretsline 105
[Credential-related source omitted] - Dangerous shell operationline 112
printf '%s' "$params" | ssh -o BatchMode=yes "$SSH_HOST" "params=\$(cat); sudo -n -u $REMOTE_USER -H $REMOTE_CLI gateway call $method --json --timeout 120000 --params \"\$params\" 2>&1"
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Combined signals: 1 fact
- Reads a credential store, and the same file sends data over the network or runs a command (line 795)autoreview/scripts/autoreview:80High confidence
Declared and executed: 1 fact
- Uses a credential store, which the skill description does not mentionautoreview/scripts/autoreview:80High confidence
Signal confidence: 498 facts
- Executable script in code of a file that runsscripts/install-skills:1High confidence
- Executable script in code of a file that runsscripts/install-skills:1High confidence
- Executable script in code of a file that runsscripts/install-skills:1High confidence
- Executable script in code of a file that runsscripts/install-skills:1High confidence
- Executable script in code of a file that runsscripts/validate-skills:1High confidence
- Executable script in code of a file that runsscripts/validate-skills:1High confidence
- Access to secrets in prose of the SKILL.mdagent-transcript/SKILL.md:51Low confidence
- Executable script in code of a file that runsagent-transcript/package.json:1High confidence
- Executable script in code of a file that runsagent-transcript/scripts/agent-transcript:1High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valueagent-transcript/scripts/agent-transcript:319Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valueagent-transcript/scripts/agent-transcript:334Low confidence
- Network access in code of a file that runsagent-transcript/scripts/agent-transcript:410High confidence
- Network access in code of a file that runsagent-transcript/scripts/agent-transcript:411High confidence
- Network access in code of a file that runsagent-transcript/scripts/agent-transcript:412High confidence
- Executable script in code of a testagent-transcript/scripts/agent-transcript.test.mjs:1Low confidence
- Network access in code of a testagent-transcript/scripts/agent-transcript.test.mjs:215Low confidence
- Network access in code of a testagent-transcript/scripts/agent-transcript.test.mjs:217Low confidence
- Network access in code of a testagent-transcript/scripts/agent-transcript.test.mjs:331Low confidence
- Network access in code of a testagent-transcript/scripts/agent-transcript.test.mjs:333Low confidence
- Network access in code of a testagent-transcript/scripts/agent-transcript.test.mjs:354Low confidence
- Network access in code of a testagent-transcript/scripts/agent-transcript.test.mjs:355Low confidence
- Network access in code of a testagent-transcript/scripts/agent-transcript.test.mjs:356Low confidence
- Network access in prose of the SKILL.mdautoreview/SKILL.md:203Low confidence
- Network access in prose of the SKILL.mdautoreview/SKILL.md:205Low confidence
- Network access in prose of documentationautoreview/references/engines.md:56Low confidence
- Network access in prose of documentationautoreview/references/engines.md:57Low confidence
- Network access in prose of documentationautoreview/references/engines.md:58Low confidence
- Network access in prose of documentationautoreview/references/engines.md:59Low confidence
- Access to secrets in prose of documentationautoreview/references/engines.md:110Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valueautoreview/references/openclaw.md:35Low confidence
- Network access in prose of documentationautoreview/references/repository-entrypoint.md:8Low confidence
- Network access in prose of documentationautoreview/references/repository-entrypoint.md:13Low confidence
- Executable script in code of a file that runsautoreview/scripts/autoreview:1High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:61High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:66High confidence
- Access to secrets in code of a file that runs: reads a credential storeautoreview/scripts/autoreview:80High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:323High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:324High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:326High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:327High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:328High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:330High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:332High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:333High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:334High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:335High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:336High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:338High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:339High confidence
- Access to secrets in code of a file that runsautoreview/scripts/autoreview:340High confidence
and 448 more
Only the first 500 facts are listed.
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md skills/agent-transcript/SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Native | Manifest AGENTS.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/agent-transcript/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/agent-transcript/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/agent-transcript/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/agent-transcript/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
Explore alternatives and comparisons
Add this badge to your README
It updates every night and links to this page.
[](https://hotskills.dev/skill/openclaw-agent-skills/)