* feat: document JSON body pattern for inline MR comments + add post-inline-comment.py script
glab api --field silently falls back to general comments when GitLab
rejects position data (common with new files, encoded paths). Fix is
to use Python urllib with Content-Type: application/json.
- glab-mr: new 'Posting Inline Comments on MR Diffs' section with
full code example, line number parsing helper, and batch script usage
- scripts/post-inline-comment.py: reusable script supporting single
and batch comment posting; auto-reads token from glab config;
reports inline vs general fallback per comment
Closes#28
* security: harden post-inline-comment.py + add openclaw.requires metadata
Security fixes before ClawHub publish:
- Enforce HTTPS-only for --host (prevents token leakage over HTTP)
- Validate --project path format with regex
- Validate --file path (no null bytes or newlines)
- Cap --body at 10,000 chars with truncation warning
- Validate --line is a positive integer
- Batch file size limit (1MB) and count limit (100 comments)
- Validate token is non-empty and whitespace-free before first API call
- Fetch token after input validation (avoids credential access on bad input)
- Explicit SSL context on all urllib calls (strict CA verification)
- Error body truncated in exception messages (prevents token reflection)
Root SKILL.md: add openclaw.requires block declaring:
- GITLAB_TOKEN credential (optional, falls back to glab config)
- Outbound HTTPS network access scope
- Write-access warning (comments, thread resolution, MR approval)
---------
Co-authored-by: Steven (Bot) <steven@winkintel.com>
Vince Lozada