$ ~/registry/skill/openclaw-agents-skills-clawsweeper

SKILL

clawsweeper

Name: clawsweeper
Author: openclaw

Handle ClawSweeper reports, fixes, merges, permissions, and GitHub workflow monitoring.

Stars

★ 382,582

Source

GitHub

Updated

2026-07-11

// securityCaution

Prompt only, no code
Open source
Community-trusted· 377.5k

Summary

Overall this is low risk with some caution: the material describes an open-source GitHub skill with no required secrets and no declared remote endpoints, suggesting mostly local/repo-scoped automation and reporting. The main item to watch is GitHub App–based repository access and writes, which is standard for this tool class.

CredentialsLow risk

No user-supplied secrets or tokens are required; the README only mentions `CLAWSWEEPER_*` config and a GitHub App private key for short-lived app-token flows, with no sign of broader credential misuse.

Network egressLow risk

No external remote endpoints or non-GitHub data-exfiltration targets are declared; visible network interaction is mainly around GitHub/GH workflows and repository operations.

Code executionCaution

It runs local builds and scripts (e.g., `pnpm run build:all`, workflow/dispatch flows), which is normal for this kind of automation skill; no system permissions beyond the described purpose are evident.

Data accessCaution

It accesses repository contents and issue/PR records, potentially reading the local workspace and GitHub-related data; however, there is no indication of overbroad or out-of-scope file access.

Supply chainCaution

The source is a GitHub open-source repo with very high community adoption, which is positive for auditability and trust; however, the license is unspecified and maintenance status is unknown, so normal supply-chain caution still applies.

Recommendations

Enable GitHub App write permissions only when needed; keep them closed by default.
Verify the workspace is clean before running, and review any changes before commit.
Apply least privilege and shortest feasible lifetime to `CLAWSWEEPER_*` private keys and short-lived tokens.
To improve trust, add an explicit license, maintenance status, and reproducible build instructions.

Audited by: gpt-5.4 · 2026-06-17

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "clawsweeper" skill from askskill:
1. Download https://raw.githubusercontent.com/openclaw/openclaw/main/.agents/skills/clawsweeper/SKILL.md
2. Save it as ~/.claude/skills/clawsweeper/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Generate repository sweep reports

Prompt

Run a ClawSweeper sweep for this OpenClaw repository and summarize issue status, PR status, failed checks, and recommended fixes by priority.

Expected

A structured sweep report with issue overview, risks, and recommended resolution order.

Trigger repair and automerge flow

Prompt

Based on the latest ClawSweeper review, apply trusted autofixes to the failing PR; if all checks pass and gates are satisfied, automerge it.

Expected

Returns repair results, change summary, gate status, and whether automerge completed.

Monitor Actions and permission issues

Prompt

Check this repository’s GitHub Actions runs, permission settings, and blocking gates, identify failure causes, and list steps for manual backfill or maintainer intervention.

Expected

A diagnostic report covering failures, permission or gate issues, and actionable remediation steps.

// docs

ClawSweeper

ClawSweeper lives at ~/Projects/clawsweeper. It is the one OpenClaw maintenance bot for sweeping, commit review, repair jobs, and guarded fix PRs. Use this skill whenever asked about reports, findings, dispatch health, repair/cloud PR creation, comment commands, automerge, permissions, or gates.

Start

cd ~/Projects/clawsweeper
git status --short --branch
git pull --ff-only
pnpm run build:all

Do not overwrite unrelated edits. If the tree is dirty, inspect first and keep read-only report work read-only unless the requester asked to commit.

One Bot, One App

Use the ClawSweeper repo and the clawsweeper GitHub App. Use only CLAWSWEEPER_* configuration for this automation. Do not use legacy apps, variables, labels, or skills.

Required app setup:

CLAWSWEEPER_APP_CLIENT_ID: public app client ID for clawsweeper.
CLAWSWEEPER_APP_PRIVATE_KEY: private key used only inside actions/create-github-app-token steps.
Target app permissions: read target scan context; write issues and pull requests; contents write for report commits, repair branches, and workflow inputs; Actions write on openclaw/clawsweeper for comment-router re-review dispatch, workflow dispatch, run cancellation, and self-heal; optional Checks write for commit Check Runs.

Token boundary:

Codex workers do not get mutation credentials.
Review workers run with stripped secret/token env.
Deterministic scripts own comments, labels, branch pushes, PR creation, closes, and merges through short-lived GitHub App tokens.
Merge and write gates default closed.

Commit Reports

Canonical commit reports:

records/<repo-slug>/commits/<40-char-sha>.md

Use the lister:

pnpm commit-reports -- --since 6h
pnpm commit-reports -- --since "24 hours ago" --findings
pnpm commit-reports -- --since 7d --non-clean
pnpm commit-reports -- --repo openclaw/openclaw --author steipete --since 7d
pnpm commit-reports -- --since 24h --json

Results: nothing_found, findings, inconclusive, failed, skipped_non_code. One report per SHA; reruns overwrite the SHA-named report.

Manual rerun/backfill:

gh workflow run commit-review.yml --repo openclaw/clawsweeper \
  -f target_repo=openclaw/openclaw \
  -f commit_sha=<end-sha> \
  -f before_sha=<start-or-parent-sha> \
  -f create_checks=false \
  -f enabled=true

Use create_checks=true only when the requester explicitly wants target commit Check Runs. Add -f additional_prompt="..." for focused one-off review instructions.

Sweep Reports

Issue/PR reports live at:

records/<repo-slug>/items/<number>.md
records/<repo-slug>/closed/<number>.md

Lead with counts, concrete findings, and report links. Do not post unsolicited GitHub comments from report-reading work. Public surfaces are markdown reports, durable ClawSweeper review comments, and optional checks.

PR reports include Codex /review-style reviewFindings with priority, confidence, repository-relative file, and line range. Public PR comments show a short Review findings: list when findings exist; full review comments, evidence links, likely owners, and runtime details stay inside the collapsed Review details block.

Useful commands:

pnpm run status
pnpm run audit
pnpm run reconcile
pnpm run apply-decisions -- --dry-run

Create One Repair Job

Create a job from issue/PR refs and a maintainer prompt:

pnpm run repair:create-job -- \
  --repo openclaw/openclaw \
  --refs 123,456 \
  --prompt-file /tmp/clawsweeper-prompt.md

Create from an existing ClawSweeper report:

pnpm run repair:create-job -- \
  --from-report ../clawsweeper/records/openclaw-openclaw/items/123.md

The job creator checks for an existing open PR, body match, or remote clawsweeper/<cluster-id> branch before writing another job. Use --dry-run to inspect. Use --force only after deciding the duplicate guard is stale.

Validate, commit, then dispatch:

…

View full docs ↗

Inspect, patch, validate, and publish OpenClaw GHSA advisories securely.

openclawGet→

$ loading_