Claude.ai requires skill names to contain only lowercase letters,
numbers, and hyphens. 'GitLab CLI Skills' → 'gitlab-cli-skills'
This constraint was not documented on the support page — discovered
via upload error.
* feat: add build-claude-skill.sh for Claude.ai integration
Closes#32
Claude.ai organization skill upload requires a zip containing exactly
one SKILL.md. The existing release zip contains 38 SKILL.md files
(one per sub-skill), causing an upload error.
Changes:
- scripts/build-claude-skill.sh: merges all sub-skill SKILL.md files
into a single consolidated SKILL.md, strips OpenClaw YAML frontmatter,
and packages the result into claude-skill.zip
- README.md: documents Claude.ai installation via pre-built zip download
or running the build script locally
- .gitignore: excludes claude-skill.zip (build artifact)
* fix: correct ZIP structure and add required YAML frontmatter
Per Claude.ai skill spec (support.claude.com):
- ZIP must contain files inside a subdirectory, not at the root:
claude-skill.zip/gitlab-cli-skills/SKILL.md ✅
claude-skill.zip/SKILL.md ❌
- SKILL.md must start with YAML frontmatter containing
'name' and 'description' fields (required by Claude.ai
to decide when to invoke the skill)
Previously the script stripped all frontmatter and placed
SKILL.md directly in the zip root — both violations of spec.
---------
Co-authored-by: Ubuntu <ubuntu@vps-9755df38.vps.ovh.us>
* feat: document JSON body pattern for inline MR comments + add post-inline-comment.py script
glab api --field silently falls back to general comments when GitLab
rejects position data (common with new files, encoded paths). Fix is
to use Python urllib with Content-Type: application/json.
- glab-mr: new 'Posting Inline Comments on MR Diffs' section with
full code example, line number parsing helper, and batch script usage
- scripts/post-inline-comment.py: reusable script supporting single
and batch comment posting; auto-reads token from glab config;
reports inline vs general fallback per comment
Closes#28
* security: harden post-inline-comment.py + add openclaw.requires metadata
Security fixes before ClawHub publish:
- Enforce HTTPS-only for --host (prevents token leakage over HTTP)
- Validate --project path format with regex
- Validate --file path (no null bytes or newlines)
- Cap --body at 10,000 chars with truncation warning
- Validate --line is a positive integer
- Batch file size limit (1MB) and count limit (100 comments)
- Validate token is non-empty and whitespace-free before first API call
- Fetch token after input validation (avoids credential access on bad input)
- Explicit SSL context on all urllib calls (strict CA verification)
- Error body truncated in exception messages (prevents token reflection)
Root SKILL.md: add openclaw.requires block declaring:
- GITLAB_TOKEN credential (optional, falls back to glab config)
- Outbound HTTPS network access scope
- Write-access warning (comments, thread resolution, MR approval)
---------
Co-authored-by: Steven (Bot) <steven@winkintel.com>
- Fixed description: 'Managed Cluster Platform' → 'Model Context Protocol'
- MCP = AI assistant integration server, not cluster management
- Updated root SKILL.md: Added (EXPERIMENTAL) flag to glab-mcp entry
- Updated help output wording in references/commands.md to match glab 1.85.0
- Changed experimental notice: 'might be broken' → 'not ready for production use'
Fixes#23 - glab-mcp had completely wrong description causing
discoverability issues for users searching for Model Context Protocol
or AI assistant integration features.
Co-authored-by: Steven (Bot) <steven@winkintel.com>
- Declare required binary: glab
- Declare optional binary: cosign (for attestation features)
- Add notes about GitLab authentication requirements
- Document potential sensitive file access (SSH keys, Docker config)
Fixes#21 - ClawHub was flagging skill as suspicious due to
mismatch between claimed requirements (none) and actual
requirements/sensitive file access. This update provides
transparency about what the skill needs and accesses.
Co-authored-by: Steven (Bot) <steven@winkintel.com>
Per OpenClaw skill-creator guide:
> A skill should only contain essential files that directly support
> its functionality. Do NOT create extraneous documentation or
> auxiliary files.
RELEASE_NOTES_BEST_PRACTICE.md contained development process notes
not needed for AI agent skill functionality.
Kept README.md for GitHub repository UI display.
Closes#17
Co-authored-by: Ubuntu <ubuntu@vps-9755df38.vps.ovh.us>
- Added decision trees to root skill:
* "Should I create an MR or work on an issue first?"
* "Which CI command should I use?" (pipeline vs job level)
* "Clone or fork?" (access and use case guidance)
* "Project vs group labels?" (scope decision tree)
- Enhanced glab-label with decision tree and workflows
- Enhanced glab-job with pipeline vs job decision tree
- Added "Related Skills" sections to all major skills:
* glab-mr → glab-issue, glab-ci, scripts
* glab-issue → glab-mr, glab-label, glab-milestone, glab-iteration, scripts
* glab-ci → glab-job, glab-schedule, glab-variable, glab-mr, scripts
* glab-repo → glab-auth, glab-ssh-key, glab-deploy-key, glab-config, glab-variable, scripts
* glab-auth → glab-config, glab-ssh-key, glab-gpg-key, glab-repo
* glab-label → glab-issue, glab-mr, scripts
* glab-job → glab-ci, glab-variable, glab-schedule, scripts
- All cross-references include relevant automation scripts
Addresses #15 Phase 3 objectives:
✅ Root skill enhanced with decision trees and navigation
✅ 4+ decision trees added to guide command selection
✅ Cross-links added between related skills
✅ "Related Skills" sections improve discoverability
✅ Decision trees provide actionable guidance
Improvements:
- Better skill discovery through cross-linking
- Decision trees reduce "which command?" confusion
- Clear guidance on pipeline vs job, clone vs fork, project vs group labels
- Scripts referenced in related skills for automation opportunities
Co-authored-by: Ubuntu <ubuntu@vps-9755df38.vps.ovh.us>
- Enhanced all skill descriptions with specific triggers and use cases
- Removed duplicate help output from top 5 skill bodies (mr, issue, ci, auth, repo)
- Added actionable workflow sections with real-world examples
- Improved root skill (gitlab-cli-skills) with better organization and common workflows
- Reduced token consumption by ~60-70% in updated skills
- Better alignment with OpenClaw progressive disclosure pattern
Addresses #11 Phase 1 objectives:
✅ All skill descriptions enhanced with triggers
✅ Duplicate content removed from SKILL.md files
✅ Workflows added to: glab-mr, glab-issue, glab-ci, glab-auth, glab-repo
✅ Root skill improved with navigation and common workflows
Skills now follow OpenClaw patterns:
- YAML frontmatter includes triggers
- Progressive disclosure (workflows in SKILL.md, details in references/)
- Concise, actionable content focused on procedural knowledge
Co-authored-by: Ubuntu <ubuntu@vps-9755df38.vps.ovh.us>
Vince Lozada