 Vince Lozada
|
732ab95906
|
security: address HIGH/MEDIUM findings from skills.sh audit (#35)
* security: address HIGH/MEDIUM findings from skills.sh audit
- Remove eval from mr-review-workflow.sh; add command allowlist
- Replace direct config file parsing with glab auth token in add-inline-comment.sh
- Add external content boundary markers to create-mr-from-issue.sh and ci-debug.sh
- Add private key upload warning to glab-ssh-key/SKILL.md
- Add prompt injection warnings to glab-api, glab-ci, glab-job SKILL.md files
- Add SECURITY.md with full security policy and guidance
Fixes #34
* chore: exclude SECURITY.md from zip export
---------
Co-authored-by: Steven (Bot) <steven@winkintel.com>
|
2026-03-04 19:41:38 -06:00 |
|
|
Vince Lozada
|
c29467a0e7
|
Phase 2: Add scripts, TOCs, and troubleshooting (#14)
- Added 5 high-value automation scripts:
* mr-review-workflow.sh - Automated MR review with tests
* create-mr-from-issue.sh - Create branch + draft MR from issue
* ci-debug.sh - Debug CI failures (find failed jobs + logs)
* batch-label-issues.sh - Apply labels to multiple issues
* sync-fork.sh - Sync fork with upstream
- Created scripts/README.md with usage documentation
- Added TOC to glab-mr/references/commands.md (656 lines)
- Updated SKILL.md files to reference relevant scripts
- Added troubleshooting sections to:
* glab-mr: merge conflicts, approval issues, pipeline problems
* glab-repo: clone failures, fork issues, transfer problems
* (glab-auth and glab-ci already had troubleshooting from Phase 1)
Addresses #13 Phase 2 objectives:
✅ 5 high-value scripts created and documented
✅ TOC added to long reference file (>100 lines)
✅ Troubleshooting sections added to top 5 skills
✅ Scripts follow OpenClaw patterns (token-efficient, deterministic)
✅ All scripts executable and well-documented
Token efficiency improvements:
- Scripts execute without loading into context
- Only script output consumes tokens
- Reduces need to regenerate same code repeatedly
- Better navigability via TOC in reference docs
Co-authored-by: Ubuntu <ubuntu@vps-9755df38.vps.ovh.us>
|
2026-02-11 22:51:20 -06:00 |
|