$ show openclaw/agent-skills
This repository is the canonical source for **OpenClaw Agent Skills**, a collection of portable, reusable agent workflows (skills) for coding agents such as Claude Code, Codex, Pi, and OpenClaw. The primary deliverable is not a standalone application but a set of self-contained skills that provide automated code review (autoreview), redacted session publication (beam), session transcript provenance (agent-transcript), local session viewing (session-viewer), behavior validation (behavior-validator), and remote test orchestration (crabbox). Each skill lives under `skills/<name>/` with a required `SKILL.md` file and auxiliary scripts, tests, and references. The repository also includes cross-platform installer (`scripts/install-skills`) and validator (`scripts/validate-skills`) scripts that support symlink or copy installation into agent skill directories. Architecturally, the skills are independent of each other and are consumed by agents via direct symlink/copy. The most complex skill is `autoreview`, which performs a full AI-driven code review pipeline: capture git diff/commit/working-tree state, build a review prompt with evidence, invoke one of several engines (Codex, Claude, Amp, Pi) via subprocess, parse structured JSON reports, and produce a final review result with security hardening (isolation probes, credential scanning, terminal escape prevention). The `autoreview` script is monolithic (~80k tokens) but contains reusable patterns for safe subprocess environment sanitization, git diff collection, JSON extraction from noisy output, and engine isolation verification. The `session-viewer` skill provides a polished local HTML renderer for agent session JSONL files, with importers for multiple session formats. The `beam` skill focuses on redacted publication of coding sessions to a read-only catalog. The codebase demonstrates high engineering craftsmanship: extensive test coverage (Python unittest, Jest for TypeScript, shell-based harness), security-conscious patterns (symlink validation, stat-preserving writes, process group signal handling, environment sanitization), and cross-platform support (Windows, macOS, Linux via CI). The test suite is especially thorough for `autoreview`, covering edge cases like CRLF handling, binary files, merge commits, worktrees, shallow clones, and sensitive path patterns. The installer pattern (symlink for development, copy for vendored snapshots) is designed to minimize drift while allowing zero-setup downstream usage. Overall, the repository is actively maintained, uses modern tooling (Python 3.14, Node 26, TypeScript 7), and is well-suited for teams adopting agent-assisted development workflows who need reusable, vetted skill definitions.
The LLM identified 5 files worth highlighting for reuse:
Self-contained Python script that installs all skills into a target directory (defaults to known agent skill dirs) via symlink for development or copy for vendored snapshots. Supports `--target`, `--mode copy`, `--force`, `--check` (preview only), and `--only` for single skill installation. Handles destination validation, overlap detection, and atomic replacement. Demonstrates a clean, reusable installer pattern applicable to any multi-component toolchain.
Standalone Python script that validates the YAML frontmatter of every `skills/*/SKILL.md` file. Checks required fields (`name`, `description`), parses YAML, and reports errors with file paths. Designed for CI integration and also callable locally via `scripts/check-skills`. Demonstrates a reusable pattern for enforcing metadata consistency across a monorepo of documentation-heavy components.
Node.js module that implements redaction and publication of coding sessions. Uses regex-based private-key detection, session cookie name filtering, hostname/account-ID redaction, and provenance tracking. Isolated, no internal dependencies beyond Node builtins. Pattern can be extracted as a generic session redaction library for any agent transcript format.
TypeScript utility for line-by-line parsing of JSONL session files. Isolated module depending only on core types (`types.ts`). Used by multiple importers (`claude.ts`, `codex.ts`, `pi-openclaw.ts`). Demonstrates a clean, testable parser pattern for structured log ingestion.
While the overall script is large and monolithic, it contains several reusable, non-obvious patterns: (1) `extract_json` and `extract_json_from_jsonl` tolerate noisy, fenced, or CRLF-delimited output and select the final valid structured result – a common need when consuming LLM output. (2) `safe_engine_env()` sanitizes the environment for child processes, stripping injection variables while forwarding safe credentials. (3) The engine isolation pattern (`ensure_*_isolation_supported`) probes the binary in a temporary directory with minimal env to confirm it does not access the host repository. These patterns can be extracted and reused in any system that launches untrusted AI subprocesses.