Abdel Sy Fane bc88e58fcf security: add skill/plugin code safety scanner (#9806) ...

* security: add skill/plugin code safety scanner module

* security: integrate skill scanner into security audit

* security: add pre-install code safety scan for plugins

* style: fix curly brace lint errors in skill-scanner.ts

* docs: add changelog entry for skill code safety scanner

* style: append ellipsis to truncated evidence strings

* fix(security): harden plugin code safety scanning

* fix: scan skills on install and report code-safety details

* fix: dedupe audit-extra import

* fix(security): make code safety scan failures observable

* fix(test): stabilize smoke + gateway timeouts (#9806) (thanks @abdelsfane)

---------

Co-authored-by: Darshil <ddhameliya@mail.sfsu.edu>
Co-authored-by: Darshil <81693876+dvrshil@users.noreply.github.com>
Co-authored-by: George Pickett <gpickett00@gmail.com>

2026-02-05 16:06:11 -08:00

..

acp

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

agents

security: add skill/plugin code safety scanner (#9806)

2026-02-05 16:06:11 -08:00

auto-reply

chore: apply local workspace updates (#9911)

2026-02-05 16:54:44 -05:00

browser

Make openclaw consistent in this file (#8533)

2026-02-04 00:02:25 -05:00

canvas-host

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

channels

feat: per-channel responsePrefix override (#9001)

2026-02-04 16:16:34 -05:00

cli

security: add skill/plugin code safety scanner (#9806)

2026-02-05 16:06:11 -08:00

commands

security: add skill/plugin code safety scanner (#9806)

2026-02-05 16:06:11 -08:00

compat

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

config

fix(telegram): accept messages from group members in allowlisted groups (#9775)

2026-02-05 14:45:45 -08:00

cron

fix(cron): handle legacy atMs field in schedule when computing next run (#9932)

2026-02-05 15:49:03 -08:00

daemon

fix(runtime): bump minimum Node.js version to 22.12.0 (#5370)

2026-02-05 13:42:52 -08:00

discord

fix: resolve discord owner allowFrom matches

2026-02-05 00:51:39 -08:00

docs

Docs: landing page revamp (#8885)

2026-02-04 10:37:14 -05:00

feishu

🤖 Feishu: tighten mention gating

2026-02-05 12:33:59 -08:00

gateway

security: add skill/plugin code safety scanner (#9806)

2026-02-05 16:06:11 -08:00

hooks

fix: harden plugin and hook install paths

2026-02-02 02:07:47 -08:00

imessage

feat: per-channel responsePrefix override (#9001)

2026-02-04 16:16:34 -05:00

infra

fix(exec-approvals): coerce bare string allowlist entries (#9903) (thanks @mcaxtr)

2026-02-05 15:52:51 -08:00

line

feat: per-channel responsePrefix override (#9001)

2026-02-04 16:16:34 -05:00

link-understanding

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

logging

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

macos

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

markdown

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

media

fix: expand SSRF guard coverage

2026-02-02 04:58:32 -08:00

media-understanding

feat: add Claude Opus 4.6 to built-in model catalog (#9853)

2026-02-05 12:09:23 -08:00

memory

chore: fix lint warnings

2026-02-02 23:45:05 -08:00

node-host

fix: harden Windows exec allowlist

2026-02-03 09:34:25 -08:00

pairing

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

plugin-sdk

feat: per-channel responsePrefix override (#9001)

2026-02-04 16:16:34 -05:00

plugins

security: add skill/plugin code safety scanner (#9806)

2026-02-05 16:06:11 -08:00

process

fix: skip extension append if command already has one

2026-01-31 20:39:33 -06:00

providers

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

routing

chore: fix lint, and format after lint to catch reformats triggered by autofixes.

2026-02-01 13:19:06 +09:00

scripts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

security

security: add skill/plugin code safety scanner (#9806)

2026-02-05 16:06:11 -08:00

sessions

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

shared/text

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

signal

feat: per-channel responsePrefix override (#9001)

2026-02-04 16:16:34 -05:00

slack

feat: per-channel responsePrefix override (#9001)

2026-02-04 16:16:34 -05:00

telegram

fix(telegram): accept messages from group members in allowlisted groups (#9775)

2026-02-05 14:45:45 -08:00

terminal

fix: error handling in restore failure reporting

2026-02-03 06:22:51 +00:00

test-helpers

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

test-utils

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

tts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

tui

Tests: restore TUI gateway env

2026-02-04 19:09:52 -05:00

types

fix: update pi packages to 0.51.0, remove bogus type augmentation

2026-02-02 01:52:33 +01:00

utils

Memory: parse quoted qmd command

2026-02-02 23:45:05 -08:00

web

chore: Typecheck test helper files.

2026-02-05 19:51:00 +09:00

whatsapp

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

wizard

onboard: use shared completion helpers for shell completion setup

2026-02-04 19:51:06 +00:00

channel-web.barrel.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

channel-web.ts

refactor!: rename chat providers to channels

2026-01-13 08:40:39 +00:00

docker-setup.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

entry.ts

fix(cli): avoid NODE_OPTIONS for --disable-warning (#9691) (thanks @18-RAJAT)

2026-02-05 12:05:14 -08:00

extensionAPI.ts

chore: Migrate to tsdown, speed up JS bundling by ~10x (thanks @hyf0).

2026-02-03 20:18:16 +09:00

globals.test.ts

chore: format to 2-space and bump changelog

2025-11-26 00:53:53 +01:00

globals.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

index.test.ts

chore: migrate to oxlint and oxfmt

2026-01-14 15:02:19 +00:00

index.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

logger.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

logger.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

logging.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

polls.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

polls.ts

chore: migrate to oxlint and oxfmt

2026-01-14 15:02:19 +00:00

runtime.ts

CLI: restore terminal state on exit

2026-02-03 06:10:19 +00:00

utils.test.ts

chore: Enable typescript/no-explicit-any rule.

2026-02-02 16:18:09 +09:00

utils.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

version.ts

fix: improve build-info resolution for commit/version

2026-02-03 17:31:51 -08:00