← 返回 Skills 市场
18594
总下载
10
收藏
185
当前安装
7
版本数
在 OpenClaw 中安装
/install openclaw-github-assistant
功能描述
Query and manage GitHub repositories - list repos, check CI status, create issues, search repos, and view recent activity.
安全使用建议
Review before installing. Use a fine-grained GitHub token limited to the repositories and permissions you actually need, avoid broad classic repo scope when possible, and require the agent to show the exact repository, title, body, branches, visibility, and any extra issue fields before creating issues, repositories, or pull requests.
功能分析
Type: OpenClaw Skill
Name: openclaw-github-assistant
Version: 2.0.1
The skill is generally well-behaved, providing GitHub integration capabilities and including responsible security warnings in its documentation (SKILL.md, README.md). It correctly handles GitHub tokens from environment variables or OpenClaw config and communicates only with api.github.com. However, the `create_issue` action in `index.js` defines an `extra` parameter of type `object` without further schema validation. This `extra` object is directly spread into the JSON body of the GitHub API request in `api.js`. This vulnerability could allow a sophisticated prompt injection attack against the AI agent to inject arbitrary fields into the GitHub issue creation request, potentially leading to unintended actions (e.g., adding assignees or labels not explicitly requested by the user) if the token has the necessary scopes. This is a vulnerability, not evidence of intentional malice by the skill developer.
能力评估
Purpose & Capability
Listing repositories, checking CI, creating issues, and creating repositories fit the GitHub assistant purpose and are mostly disclosed, but the exported create_pull_request action is present in code and types while absent from the main README and SKILL capability lists.
Instruction Scope
The skill can create issues, repositories, and pull requests through authenticated POST requests using ambient credentials, with no explicit confirmation or preview step in the implementation; create_issue also passes an unrestricted extra object into the GitHub API body.
Install Mechanism
No install script, dependency installer, obfuscation, or setup-time execution was found. Package metadata has minor quality issues, including duplicate package.json keys and a version mismatch between package.json and exported skill metadata.
Credentials
GitHub token and username access are expected for this integration and are declared in SKILL.md metadata; outbound API use appears limited to api.github.com, but the documented classic repo scope can grant broad private repository authority.
Persistence & Privilege
No background worker, local indexing, privilege escalation, or self-persistence was found. Persistence is limited to user-provided environment/config credentials and an in-memory cached username.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install openclaw-github-assistant - 安装完成后，直接呼叫该 Skill 的名称或使用
/openclaw-github-assistant触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v2.0.1
**Expanded TypeScript and API Support in v2.0.1**
- Added type definitions and API modules: `api.d.ts`, `api.js`, `index.d.ts`, `types.d.ts`, and `types.js`
- Updated main skill logic and package metadata in `index.js` and `package.json`
- Improved maintainability and type safety for developers integrating with the skill
v2.0.0
Refactored to TypeScript - Better type safety and IDE support. All functions tested and working.
v1.0.4
Added create_pull_request feature - Now you can create PRs from conversation!
v1.0.3
Added create_repo feature - Now you can create new repositories directly from conversation!
v1.0.2
Added test suite with 7 tests. Fixed registry metadata to declare required credentials (GITHUB_TOKEN, GITHUB_USERNAME).
v1.0.1
Fixed credential handling: Code now properly reads GITHUB_TOKEN and GITHUB_USERNAME from environment variables.
v1.0.0
Initial release: List repos, check CI status, create issues, search repos, view recent activity
元数据
常见问题
OpenClaw GitHub Assistant 是什么？
Query and manage GitHub repositories - list repos, check CI status, create issues, search repos, and view recent activity. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 18594 次。
如何安装 OpenClaw GitHub Assistant？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install openclaw-github-assistant」即可一键安装，无需额外配置。
OpenClaw GitHub Assistant 是免费的吗？
是的，OpenClaw GitHub Assistant 完全免费（开源免费），可自由下载、安装和使用。
OpenClaw GitHub Assistant 支持哪些平台？
OpenClaw GitHub Assistant 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 OpenClaw GitHub Assistant？
由 conorkenn（@conorkenn）开发并维护，当前版本 v2.0.1。
推荐 Skills