Security Triage

This handles the workflow of triaging security advisories for OpenClaw without overclosing real issues or shipping unnecessary regressions. It walks you through reading SECURITY.md, pulling GHSA details via the GitHub API, checking shipped tags and npm releases, and deciding whether to close, keep open, or narrow scope. The skill enforces a strict one-advisory-at-a-time flow, copies maintainer-ready comments to your clipboard, and separates vulnerability status from optional hardening. It's built around a trust model framework that distinguishes between real boundary bypasses and issues that fall within documented threat models. Useful if you maintain a project with active security reports and need consistent triage discipline.

skills.sh installs: 172
GitHub stars: 376.2K
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add steipete/clawdis --skill security-triage --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Triage

Use when reviewing OpenClaw security advisories, drafts, or GHSA reports.

Goal: high-confidence maintainers' triage without over-closing real issues or shipping unnecessary regressions.

Close Bar

Close only if one of these is true:

duplicate of an existing advisory or fixed issue
invalid against shipped behavior
out of scope under SECURITY.md
fixed before any affected release/tag

Do not close only because main is fixed. If latest shipped tag or npm release is affected, keep it open until released or published with the right status.

Required Reads

Before answering:

Read SECURITY.md.
Read the GHSA body with gh api /repos/openclaw/openclaw/security-advisories/<GHSA>.
Inspect the exact implicated code paths.
Verify shipped state:
- git tag --sort=-creatordate | head
- npm view openclaw version --userconfig "$(mktemp)"
- git tag --contains <fix-commit>
- if needed: git show <tag>:path/to/file
Search for canonical overlap:
- existing published GHSAs
- older fixed bugs
- same trust-model class already covered in SECURITY.md