$ loading_
Helps maintainers triage, clean up, and resolve OpenClaw secret scanning alerts.
Overall risk appears low. The skill is focused on GitHub secret-scanning remediation inside the repository; while it uses maintainer-level actions and scripted API operations, the available facts show it is open source, highly trusted by the community, and do not indicate unrelated data exfiltration or clear credential-abuse red flags.
No extra secret or environment variable is declared, but the README explicitly requires repo admin/maintainer permissions. In practice this implies a high-privilege GitHub identity context for deleting comments, recreating comments, and resolving alerts. No third-party credential collection is described, but misuse of elevated repository privileges should be considered.
The README describes API actions such as fetch, notify, and resolve against GitHub secret-scanning and comment-related endpoints, including posting notification comments back to GitHub. The data flow appears related to the stated function, and no unknown or unrelated endpoint is indicated, so this is a standard but notable network interaction.
The documentation explicitly references a local Node script, `secret-scanning.mjs`, for mechanical operations and mentions `mktemp`, file-upload flags, and multiple commands, indicating local process execution. This is part of the skill's implementation, and no unrelated or excessive system privilege request is evident.
The skill reads issue/PR/comment content tied to secret-scanning alerts and saves body content to temporary files before deletion, recreation, or in-place redaction. This gives it access to potentially sensitive repository text and edit-history-related metadata. The README notes controls such as `hide_secret=true` and not printing secrets/body to stdout, but the access scope should still be limited under least privilege.
The source is an open-source GitHub repository with very high community adoption (about 377k stars), which is a strong risk-reducing signal. The license and maintenance status are not clearly stated in the provided material, leaving some governance uncertainty, but there is no sign here of a closed-source opaque package, deceptive origin, or suspicious delivery pattern.
Copy the install command and let the AI configure it · recommended for beginners
Please install the "openclaw-secret-scanning-maintainer" skill from askskill: 1. Download https://raw.githubusercontent.com/openclaw/openclaw/main/.agents/skills/openclaw-secret-scanning-maintainer/SKILL.md 2. Save it as ~/.claude/skills/openclaw-secret-scanning-maintainer/SKILL.md 3. Reload skills and tell me it's ready
Review this OpenClaw Secret Scanning alert in a GitHub PR, determine whether it is a real leak, and provide steps to redact it, revoke the secret, clean the commit history, and close the alert.
A triage decision plus a checklist for remediation, redaction, secret rotation, and alert resolution.
A GitHub issue may have exposed an access token. Explain how to verify the risk, edit or redact the content, notify the right people, and document follow-up remediation.
An issue-specific response plan covering risk validation, content cleanup, notifications, and documentation.
Help me organize recent OpenClaw Secret Scanning alerts in the repository, grouping them into false positives, resolved cases, and pending issues, with recommended next steps for each.
A categorized alert list with recommended actions and priority guidance for each group.
Maintainer-only. This skill requires repo admin / maintainer permissions to edit or delete other users' comments and resolve secret scanning alerts.
Use this skill when processing alerts from https://github.com/openclaw/openclaw/security/secret-scanning.
Language rule: All notification comments and replacement comments MUST be written in English.
All mechanical operations (API calls, temp file management, security enforcements) are handled by:
$REPO_ROOT/.agents/skills/openclaw-secret-scanning-maintainer/scripts/secret-scanning.mjs
The script enforces:
hide_secret=true on all alert fetches (no plaintext secrets in stdout)mktemp with random UUIDs for all temp files-F body=@file for all body uploads (no inline shell quoting).secret or .body to stdoutSupports single or multiple alerts. For multiple alerts, process in ascending order.
For each alert:
fetch-alert + fetch-content to get metadata and bodyredact-body-if-needed for issue/PR body; skip for comments (delete directly)delete-comment + recreate-comment for comments; cannot purge body historynotify posts the right template per location type, unless the current issue/PR body is already redactedresolve closes the alertsummary prints formatted results# List all open alerts
node secret-scanning.mjs list-open
# Fetch specific alert metadata + locations
node secret-scanning.mjs fetch-alert <NUMBER>
# Fetch content for each location (saves body to temp file)
node secret-scanning.mjs fetch-content '<location-json>'
The fetch-content output includes:
body_file: path to temp file with full body contentauthor: who posted itissue_number / pr_number: where it isedit_history_count: number of existing editstype: location type for routingdiscussion_comment, it also includes comment_node_id, discussion_node_id, and reply_to_node_id when the original comment was a reply.| type | Flow |
|---|---|
issue_comment | Comment: delete+recreate |
pull_request_comment | Comment: delete+recreate |
pull_request_review_comment | Comment: delete+recreate |
discussion_comment | Discussion comment: delete+recreate (GraphQL) |
issue_body | Body: redact in place |
pull_request_body | Body: redact in place |
commit | Notify only |
| other | Skip and report |
The agent reads the body file from fetch-content output and:
[REDACTED <secret_type>] — no partial values, no prefix/suffixThis is the only step that requires semantic understanding. Everything else is mechanical.
For issue_body and pull_request_body: if the current body has already been redacted by the author and no plaintext credential remains, do not post a public notification comment. Resolve the alert with a maintainer-only resolution comment such as:
…
Create and review technical docs and agent instruction files in repositories.
Verify an OpenClaw release is fully published and working across all channels.
Fetch GitHub issues, create fixes, open PRs, and handle reviews.
Convert text to speech locally and offline with sherpa-onnx, no cloud needed.
Regenerate OpenClaw release changelog sections from Git history before releases.
Navigate Feishu knowledge bases and surface relevant wiki pages and links.
Inspect, patch, validate, and publish OpenClaw GHSA advisories securely.
Triage security advisories, drafts, and GHSA reports with trusted evidence.
Handle ClawSweeper reports, fixes, merges, permissions, and GitHub workflow monitoring.
Review, triage, and manage OpenClaw issues and pull requests faster.
Run, debug, monitor, and summarize OpenClaw release CI workflows.
Prepare and verify OpenClaw stable or beta releases and release notes.