Peter Steinberger
f717a13039
refactor(agent): dedupe harness and command workflows
2026-02-16 14:59:30 +00:00
Sebastian
c8e110e2e3
refactor(skills): extract installer strategy helpers
2026-02-15 22:32:51 -05:00
McRolly NWANGWU
d19b746928
feat(skills): add cross-platform install fallback for non-brew environments ( #17687 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 3ed485083860803337+mcrolly@users.noreply.github.com >
Co-authored-by: sebslight <19554889+sebslight@users.noreply.github.com >
Reviewed-by: @sebslight
2026-02-15 22:25:26 -05:00
Peter Steinberger
2363e1b085
fix(security): restrict skill download target paths
2026-02-16 03:47:28 +01:00
Peter Steinberger
3aa94afcfd
fix(security): harden archive extraction ( #16203 )
...
* fix(browser): confine upload paths for file chooser
* fix(browser): sanitize suggested download filenames
* chore(lint): avoid control regex in download sanitizer
* test(browser): cover absolute escape paths
* docs(browser): update upload example path
* refactor(browser): centralize upload path confinement
* fix(infra): harden tmp dir selection
* fix(security): harden archive extraction
* fix(infra): harden tar extraction filter
2026-02-14 14:42:08 +01:00
Yi Liu
d3aee84499
fix(security): add --ignore-scripts to skills install commands ( #14659 )
...
Skills install runs package manager install commands (npm, pnpm, yarn,
bun) without --ignore-scripts, allowing malicious npm packages to
execute arbitrary code via postinstall/preinstall lifecycle scripts
during global installation.
This is inconsistent with the security fix in commit 92702af7a
2026-02-13 02:56:35 +09:00
Abdel Sy Fane
bc88e58fcf
security: add skill/plugin code safety scanner ( #9806 )
...
* security: add skill/plugin code safety scanner module
* security: integrate skill scanner into security audit
* security: add pre-install code safety scan for plugins
* style: fix curly brace lint errors in skill-scanner.ts
* docs: add changelog entry for skill code safety scanner
* style: append ellipsis to truncated evidence strings
* fix(security): harden plugin code safety scanning
* fix: scan skills on install and report code-safety details
* fix: dedupe audit-extra import
* fix(security): make code safety scan failures observable
* fix(test): stabilize smoke + gateway timeouts (#9806 ) (thanks @abdelsfane)
---------
Co-authored-by: Darshil <ddhameliya@mail.sfsu.edu >
Co-authored-by: Darshil <81693876+dvrshil@users.noreply.github.com >
Co-authored-by: George Pickett <gpickett00@gmail.com >
2026-02-05 16:06:11 -08:00
Peter Steinberger
9bd64c8a1f
fix: expand SSRF guard coverage
2026-02-02 04:58:32 -08:00
cpojer
f06dd8df06
chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.
2026-02-01 10:03:47 +09:00
cpojer
5ceff756e1
chore: Enable "curly" rule to avoid single-statement if confusion/errors.
2026-01-31 16:19:20 +09:00
Peter Steinberger
9a7160786a
refactor: rename to openclaw
2026-01-30 03:16:21 +01:00
Peter Steinberger
6d16a658e5
refactor: rename clawdbot to moltbot with legacy compat
2026-01-27 12:21:02 +00:00
Peter Steinberger
a4fc2b4536
fix: handle fetch streams safely
2026-01-21 01:24:29 +00:00
Peter Steinberger
48b0d08493
fix: resolve ReadableStream cast in skills install
2026-01-21 00:33:22 +00:00
Peter Steinberger
76bae8da40
feat: add download installs for skills
2026-01-21 00:14:36 +00:00
Peter Steinberger
c379191f80
chore: migrate to oxlint and oxfmt
...
Co-authored-by: Christoph Nakazawa <christoph.pojer@gmail.com >
2026-01-14 15:02:19 +00:00
Peter Steinberger
79f813e18e
style: format lint offenders
2026-01-07 00:04:44 +01:00
Peter Steinberger
18c43fe462
fix: bootstrap linuxbrew for skills
2026-01-06 23:27:38 +01:00
Peter Steinberger
246adaa119
chore: rename project to clawdbot
2026-01-04 14:38:51 +00:00
Peter Steinberger
1a3323a261
fix(cli): improve skill install failure output
2026-01-01 22:55:15 +01:00
Peter Steinberger
73d0e2cb81
fix: gate skills by OS
2026-01-01 22:25:37 +01:00
Peter Steinberger
35b66e5ad1
feat: add onboarding wizard
2026-01-01 17:58:07 +01:00
Peter Steinberger
7a88071a16
style: format skill installer logic
2025-12-20 18:01:09 +01:00
Peter Steinberger
4c054917ef
feat: add uv skill installers
2025-12-20 17:50:29 +01:00
Peter Steinberger
4ee292a952
refactor: drop pnpm skill installer
2025-12-20 17:39:54 +01:00
Peter Steinberger
ba0791b896
feat: add skills search and website
2025-12-20 17:32:40 +01:00
Peter Steinberger
c4a67b7d02
feat: refresh skills metadata and toggles
2025-12-20 17:32:05 +01:00
Peter Steinberger
137980b46e
fix(agents): support loadSkillsFromDir result
2025-12-20 13:31:46 +00:00
Peter Steinberger
e0cd5650c5
style: biome formatting
2025-12-20 12:52:14 +00:00
Peter Steinberger
cc0075e988
feat: add skills settings and gateway skills management
2025-12-20 13:33:42 +01:00
