Claude.ai requires skill names to contain only lowercase letters,
numbers, and hyphens. 'GitLab CLI Skills' → 'gitlab-cli-skills'
This constraint was not documented on the support page — discovered
via upload error.
* feat: add build-claude-skill.sh for Claude.ai integration
Closes#32
Claude.ai organization skill upload requires a zip containing exactly
one SKILL.md. The existing release zip contains 38 SKILL.md files
(one per sub-skill), causing an upload error.
Changes:
- scripts/build-claude-skill.sh: merges all sub-skill SKILL.md files
into a single consolidated SKILL.md, strips OpenClaw YAML frontmatter,
and packages the result into claude-skill.zip
- README.md: documents Claude.ai installation via pre-built zip download
or running the build script locally
- .gitignore: excludes claude-skill.zip (build artifact)
* fix: correct ZIP structure and add required YAML frontmatter
Per Claude.ai skill spec (support.claude.com):
- ZIP must contain files inside a subdirectory, not at the root:
claude-skill.zip/gitlab-cli-skills/SKILL.md ✅
claude-skill.zip/SKILL.md ❌
- SKILL.md must start with YAML frontmatter containing
'name' and 'description' fields (required by Claude.ai
to decide when to invoke the skill)
Previously the script stripped all frontmatter and placed
SKILL.md directly in the zip root — both violations of spec.
---------
Co-authored-by: Ubuntu <ubuntu@vps-9755df38.vps.ovh.us>
* feat: document JSON body pattern for inline MR comments + add post-inline-comment.py script
glab api --field silently falls back to general comments when GitLab
rejects position data (common with new files, encoded paths). Fix is
to use Python urllib with Content-Type: application/json.
- glab-mr: new 'Posting Inline Comments on MR Diffs' section with
full code example, line number parsing helper, and batch script usage
- scripts/post-inline-comment.py: reusable script supporting single
and batch comment posting; auto-reads token from glab config;
reports inline vs general fallback per comment
Closes#28
* security: harden post-inline-comment.py + add openclaw.requires metadata
Security fixes before ClawHub publish:
- Enforce HTTPS-only for --host (prevents token leakage over HTTP)
- Validate --project path format with regex
- Validate --file path (no null bytes or newlines)
- Cap --body at 10,000 chars with truncation warning
- Validate --line is a positive integer
- Batch file size limit (1MB) and count limit (100 comments)
- Validate token is non-empty and whitespace-free before first API call
- Fetch token after input validation (avoids credential access on bad input)
- Explicit SSL context on all urllib calls (strict CA verification)
- Error body truncated in exception messages (prevents token reflection)
Root SKILL.md: add openclaw.requires block declaring:
- GITLAB_TOKEN credential (optional, falls back to glab config)
- Outbound HTTPS network access scope
- Write-access warning (comments, thread resolution, MR approval)
---------
Co-authored-by: Steven (Bot) <steven@winkintel.com>
Vince Lozada