name	skill-scanner
description	Run both the skill-structure gate and the CodeQL SDK security scan, then report a compact ready-to-submit status block.

Skill Scanner

Run both the skill-structure gate and the CodeQL SDK security scan, then report a compact ready-to-submit status block.

Validate skill structure with openclaw skills check and package_skill.py before scanning
Run the codeql-sdk audit with --fail-on-high and emit JSON plus optional SARIF reports for CI/ClawHub
Produce a handoff summary (structure, package, scan status, report path, ready-to-submit) for maintainers or ClawHub

If CodeQL finds no analyzable source, mark the scan not applicable rather than passed; never substitute weaker checks
If the CodeQL CLI is missing, report it as a blocker and ask before installing it (machine-level change)
Do not commit .scan-reports/ or print secrets; summarize only rule IDs, severity, file paths, and line numbers

Confirm the user intent and whether the action is read-only or state-changing.
Use the narrowest available tool scope and collect only the context needed for the task.
For state-changing or external actions, stop for explicit approval before acting.
Summarize what changed or what was learned, including relevant object IDs or links.

name	skill-scanner
description	Run both the skill-structure gate and the CodeQL SDK security scan, then report a compact ready-to-submit status block.

Run both the skill-structure gate and the CodeQL SDK security scan, then report a compact ready-to-submit status block.

Validate skill structure with openclaw skills check and package_skill.py before scanning
Run the codeql-sdk audit with --fail-on-high and emit JSON plus optional SARIF reports for CI/ClawHub
Produce a handoff summary (structure, package, scan status, report path, ready-to-submit) for maintainers or ClawHub

If CodeQL finds no analyzable source, mark the scan not applicable rather than passed; never substitute weaker checks
If the CodeQL CLI is missing, report it as a blocker and ask before installing it (machine-level change)
Do not commit .scan-reports/ or print secrets; summarize only rule IDs, severity, file paths, and line numbers

Confirm the user intent and whether the action is read-only or state-changing.
Use the narrowest available tool scope and collect only the context needed for the task.
For state-changing or external actions, stop for explicit approval before acting.
Summarize what changed or what was learned, including relevant object IDs or links.

skill-scanner