Remove openclaw platform references from SKILL.md#39
Open
Conversation
Remove the `openclaw browserbase setup` command reference from the browser skill SKILL.md. This reference was causing ClawHub's OpenClaw security scanner to flag the skill as "Suspicious" because it implies undeclared file access to ~/.openclaw/openclaw.json. The skill only needs BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID env vars, which are already documented. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
shrey150
force-pushed
the
shrey/fix-clawhub-security-scan
branch
from
8a34f6a to
0a4ce11
Compare
The ClawHub security scanner reads all skill files, not just SKILL.md. Remove remaining openclaw credential bridging, eval, and setup command references from REFERENCE.md and EXAMPLES.md. Replace with direct env var export instructions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openclawplatform references frombrowser/SKILL.md,browser/REFERENCE.md, andbrowser/EXAMPLES.md~/.openclaw/openclaw.jsonand undeclared credential bridging behavioropenclaw browserbase setupandeval "$(openclaw browserbase env ...)"with directexportenv var instructionsBROWSERBASE_API_KEYandBROWSERBASE_PROJECT_IDenv vars — how users set them is not the skill's concernChanges
openclaw browserbase setupfallback instructionbrowse env remoteContext
The ClawHub scanner reads all skill files (not just SKILL.md) and flags mismatches between declared metadata and runtime instructions. Passing skills like
githubandweathernever reference OpenClaw platform internals — they just declare what they need and let the platform handle the rest.Test plan
🤖 Generated with Claude Code
Note
Low Risk
Documentation-only updates that remove references to OpenClaw plugin setup and local credential bridging; no runtime or API behavior changes.
Overview
Removes OpenClaw platform-specific credential setup guidance (
openclaw browserbase setupand JSON-to-env “bridging”) from the browser skill documentation, standardizing remote-mode instructions on settingBROWSERBASE_API_KEYandBROWSERBASE_PROJECT_IDdirectly.Updates the remote-mode example flow to explicitly run
browse env remoteafter exporting credentials, and makes small wording/example tweaks inREFERENCE.md(e.g.,fillexample text and credential source link).Written by Cursor Bugbot for commit 46cf406. This will update automatically on new commits. Configure here.