Verdaccio Pull Request Workflow
verdaccio/verdaccio
Takes a change through a verdaccio pull request: branch, local checks, changeset, title and body, labels, CI and review rounds, and ports to other release lines.
Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to…
Install Security Triage
$ npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install SafeAI-Lab-X/ClawKeeper security-triage --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/SafeAI-Lab-X/ClawKeeper.git skills-src && mkdir -p .claude/skills && cp -r skills-src/legacy/clawkeeper-watcher/.agents/skills/security-triage .claude/skills/security-triage && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-triage" agent skill from https://github.com/SafeAI-Lab-X/ClawKeeper/tree/main/legacy/clawkeeper-watcher/.agents/skills/security-triage into .claude/skills/security-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-triage", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/SafeAI-Lab-X/ClawKeeper/tree/main/legacy/clawkeeper-watcher/.agents/skills/security-triageType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install SafeAI-Lab-X/ClawKeeper security-triage --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SafeAI-Lab-X/ClawKeeper.git skills-src && mkdir -p .agents/skills && cp -r skills-src/legacy/clawkeeper-watcher/.agents/skills/security-triage .agents/skills/security-triage && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-triage" agent skill from https://github.com/SafeAI-Lab-X/ClawKeeper/tree/main/legacy/clawkeeper-watcher/.agents/skills/security-triage into .agents/skills/security-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-triage", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install SafeAI-Lab-X/ClawKeeper security-triage --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SafeAI-Lab-X/ClawKeeper.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/legacy/clawkeeper-watcher/.agents/skills/security-triage .cursor/skills/security-triage && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-triage" agent skill from https://github.com/SafeAI-Lab-X/ClawKeeper/tree/main/legacy/clawkeeper-watcher/.agents/skills/security-triage into .cursor/skills/security-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-triage", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/SafeAI-Lab-X/ClawKeeper.git --path legacy/clawkeeper-watcher/.agents/skills/security-triage--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install SafeAI-Lab-X/ClawKeeper security-triage --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SafeAI-Lab-X/ClawKeeper.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/legacy/clawkeeper-watcher/.agents/skills/security-triage .gemini/skills/security-triage && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-triage" agent skill from https://github.com/SafeAI-Lab-X/ClawKeeper/tree/main/legacy/clawkeeper-watcher/.agents/skills/security-triage into .gemini/skills/security-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-triage", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install SafeAI-Lab-X/ClawKeeper security-triageInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/SafeAI-Lab-X/ClawKeeper.git skills-src && mkdir -p .github/skills && cp -r skills-src/legacy/clawkeeper-watcher/.agents/skills/security-triage .github/skills/security-triage && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-triage" agent skill from https://github.com/SafeAI-Lab-X/ClawKeeper/tree/main/legacy/clawkeeper-watcher/.agents/skills/security-triage into .github/skills/security-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-triage", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install SafeAI-Lab-X/ClawKeeper security-triage --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SafeAI-Lab-X/ClawKeeper.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/legacy/clawkeeper-watcher/.agents/skills/security-triage .opencode/skills/security-triage && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-triage" agent skill from https://github.com/SafeAI-Lab-X/ClawKeeper/tree/main/legacy/clawkeeper-watcher/.agents/skills/security-triage into .opencode/skills/security-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-triage", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-triage- GitHub stars
- 1k
- Token cost
- ~934 tokens
- SKILL.md length
- 412 words
- Files
- 1
- Skills in repo
- 11
- Repo updated
- First seen
- Licence
- None found
At a glance
Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to…
- Works in 5 steps: Read SECURITY.md. → Read the GHSA body with gh api… → Inspect the exact implicated code paths. → …
- Development work in your project
- SKILL.md covers Close Bar, Required Reads, Review Method and Response Format, plus 3 more sections
- Calls git, gh and npm
What it does
Security Triage is an agent skill from SafeAI-Lab-X/ClawKeeper. Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.
Its SKILL.md is about 930 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Development. It works with GitHub, Git and npm. The repository describes itself as: ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers (aka The Norton for OpenClaw).
When your agent uses it
- Development work in your project
Example prompts
- “/security-triage”
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Read SECURITY.md.
- Read the GHSA body with gh api /repos/openclaw/openclaw/security-advisories/.
- Inspect the exact implicated code paths.
- Verify shipped state
- Search for canonical overlap
What it can do on your machine
Read from SKILL.md and the folder at commit 69db077. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
gitghnpm
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use git, gh and npm, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Triage loads about 934 tokens when it runs. Until then it costs about 60 tokens; SKILL.md has 412 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 412 words (~934 tokens).
“Use when reviewing OpenClaw security advisories, drafts, or GHSA reports.”
- name
- security-triage
Files
Just SKILL.md in legacy/clawkeeper-watcher/.agents/skills/security-triage of SafeAI-Lab-X/ClawKeeper.
Open the folder on GitHubat commit 69db077
Compare with similar skills
Security Triage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Triage this skillSafeAI-Lab-X/ClawKeeper | 1k | — | ~934 | Automated safety check: Pass | None | |
| Verdaccio Pull Request Workflowverdaccio/verdaccio | 18k | — | ~1.9k | Automated safety check: Pass | MIT | |
| Hunk Release Workflowmodem-dev/hunk | 9.6k | — | ~3.8k | Automated safety check: Pass | MIT | |
| ZCF Release AutomationUfoMiao/zcf | 6.1k | — | ~3.4k | Automated safety check: Pass | MIT | |
| Deploy Docstryonlabs/opentryon | 551 | — | ~1.2k | Automated safety check: Notes | Custom licence | |
| ClawRouter Release ChecklistBlockRunAI/ClawRouter | 6.6k | — | ~1.4k | Automated safety check: Pass | MIT |
Similar skills
Hunk Release Workflow
modem-dev/hunk
Maintainer workflow for preparing, publishing, verifying and curating Hunk releases, with confirmation gates before tags, publishes and public edits.
ZCF Release Automation
UfoMiao/zcf
Automates a version release with changesets: analyzes code changes, writes a bilingual CHANGELOG, bumps the version and commits through a release branch and pull request.
Deploy Docs
tryonlabs/opentryon
Builds the OpenTryOn Docusaurus site in docs/, commits and pushes to the docs branch, and deploys GitHub Pages (gh-pages).
ClawRouter Release Checklist
BlockRunAI/ClawRouter
Walks the agent through every ClawRouter release step in order, from the version bump and changelog entry to build, tests, npm publish, git tag and GitHub release.
Release Clawpatch
openclaw/clawpatch
clawpatch release: version/changelog, CI, npm publish, GitHub release, verify.
More from SafeAI-Lab-X/ClawKeeper
All 11 skills in this repoClawkeeper
SafeAI-Lab-X/ClawKeeper
Install, configure, verify, and debug the Clawkeeper watcher stack in this workspace.
Feishu Safety Guide
SafeAI-Lab-X/ClawKeeper
One-click deployment Skill for Feishu security governance and message anti-data-leakage guide, responsible for Feishu message security, credential protection, permission auditing, interaction…
Node Connect
SafeAI-Lab-X/ClawKeeper
Diagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps.
Openclaw Ghsa Maintainer
SafeAI-Lab-X/ClawKeeper
Maintainer workflow for OpenClaw GitHub Security Advisories (GHSA).
Openclaw PR Maintainer
SafeAI-Lab-X/ClawKeeper
Maintainer workflow for reviewing, triaging, preparing, closing, or landing OpenClaw pull requests and related issues.
Openclaw Release Maintainer
SafeAI-Lab-X/ClawKeeper
Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation.
Related
Categories
Questions about Security Triage
What does Security Triage do?
Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to…. Security Triage is an agent skill from SafeAI-Lab-X/ClawKeeper. Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.
When should I use Security Triage?
Security Triage fits situations like: development work in your project.
How do I install Security Triage in Claude Code?
Run `npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a claude-code`. Or copy the skill folder (legacy/clawkeeper-watcher/.agents/skills/security-triage in SafeAI-Lab-X/ClawKeeper) into .claude/skills/security-triage in your project. Claude Code loads it when a task matches its description.
How do I install Security Triage in Codex?
Run `npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a codex`. Or copy the skill folder (legacy/clawkeeper-watcher/.agents/skills/security-triage in SafeAI-Lab-X/ClawKeeper) into .agents/skills/security-triage in your project. Codex loads it when a task matches its description.
Can I use Security Triage in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add SafeAI-Lab-X/ClawKeeper --skill security-triage -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-triage, .gemini/skills/security-triage, .github/skills/security-triage and .opencode/skills/security-triage in your project.
What does Security Triage need to run?
Going by SKILL.md and its folder, Security Triage needs the command-line tools its instructions call (git, gh and npm).
Does Security Triage access the network?
SKILL.md contains no URLs. Its commands use git, gh and npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Security Triage safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Triage use?
No licence was found for Security Triage or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Security Triage use?
About 934 tokens (SKILL.md is roughly 3.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Triage?
Skills that share tags, products or a category with Security Triage: Verdaccio Pull Request Workflow (verdaccio/verdaccio, 18k stars), Hunk Release Workflow (modem-dev/hunk, 9.6k stars), ZCF Release Automation (UfoMiao/zcf, 6.1k stars) and Deploy Docs (tryonlabs/opentryon, 551 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Triage?
SafeAI-Lab-X (a GitHub user) maintains it in SafeAI-Lab-X/ClawKeeper, which has 1,024 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on August 17, 2026.
Source: SafeAI-Lab-X/ClawKeeper on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.