fix(skills): resolve `skills info` name mismatches by NewdlDewdl · Pull Request #38713 · openclaw/openclaw

NewdlDewdl · 2026-03-07T09:19:25Z

Summary

make openclaw skills info <name> resolve skills using exact, case-insensitive, and separator-normalized matching
require non-exact fallback matches to be unique so ambiguous case or separator variants return not-found instead of selecting the wrong skill
trim and sanitize the requested skill name in not-found JSON/text responses for cleaner UX
add formatter coverage for exact fallback behavior, ambiguous fallback behavior, and sanitized not-found output

Why

Fixes #38546 where skills can show as ready in skills list but fail lookup in skills info due strict identifier matching.

Supersedes #38701, which was auto-closed by queue-limit automation while active PR count was over threshold.

Real behavior proof

Behavior or issue addressed: openclaw skills info <name> now resolves list-visible skills when the requested token differs only by case or common separators, while ambiguous fallback matches return not-found rather than choosing the wrong skill.
Real environment tested: Local OpenClaw CLI command path on macOS using a redacted local skills-status fixture. The fixture only changed skill names/keys and did not expose local paths or secrets.
Exact steps or command run after this patch: Ran the skills info command path through a temporary local behavior-proof harness with pnpm test src/cli/skills-cli.behavior-proof.temp.test.ts --reporter=verbose, which invoked openclaw skills info excel-xlsx against redacted fixture variants.
Evidence after fix: Terminal output from the local command-path proof:

$ openclaw skills info excel-xlsx --json  # redacted fixture: skillKey=Excel-XLSX
{"name":"Excel XLSX","skillKey":"Excel-XLSX"}

$ openclaw skills info excel-xlsx --json  # redacted fixture: skillKey=excel_xlsx
{"name":"Excel XLSX","skillKey":"excel_xlsx"}

$ openclaw skills info excel-xlsx  # redacted fixture: ambiguous normalized names
Skill "excel-xlsx" not found. Run `openclaw skills list` to see available skills.

Observed result after fix: The CLI resolved the unique case-insensitive and separator-normalized variants to the intended skill, and returned not-found for ambiguous normalized matches instead of displaying details for the wrong skill.
What was not tested: No live third-party skill registry access or secret-backed skill configuration was tested.

Testing

pnpm build
pnpm test src/cli/skills-cli.test.ts
pnpm exec oxlint src/cli/skills-cli.format.ts src/cli/skills-cli.test.ts

AI-assisted disclosure

AI-assisted: yes

greptile-apps · 2026-03-07T09:21:54Z

Greptile Summary

This PR fixes a real-world UX bug (#38546) where skills visible in skills list could silently fail lookup in skills info due to strict identifier matching. The fix introduces a three-phase resolution strategy (exact → case-insensitive → separator-normalized) in a new resolveSkillByName helper, replacing the single .find() call in formatSkillInfo.

Key changes:

New normalizeSkillLookupToken function that lowercases and folds whitespace, underscores, and forward slashes into dashes, strips non-alphanumeric characters, and collapses/trims dashes.
New resolveSkillByName function that applies exact match, then case-insensitive match, then normalized match, returning the first hit or null.
formatSkillInfo now trims the skillName argument before using it in error messages (cleaner UX for whitespace-padded input).
Two new unit tests cover the case-insensitive (Excel-XLSX → excel-xlsx) and separator-variant (excel_xlsx / Excel XLSX → excel-xlsx) paths.

The implementation is clean, name and skillKey are both typed as non-optional string in SkillStatusEntry so there is no null-safety risk in .toLowerCase() calls. The three-pass approach means well-formed exact keys are never slowed down by normalization, and normalizeSkillLookupToken is only invoked on the full skill list in the fallback path — perfectly acceptable for a CLI context.

Confidence Score: 5/5

This PR is safe to merge — it is a backward-compatible, purely additive change with no runtime risk.
The change is self-contained to two files (formatter + tests). Both name and skillKey are guaranteed non-nullable strings in SkillStatusEntry, so no null-safety issues arise. The three-phase lookup is strictly a superset of the old single-phase lookup (exact match still works identically), meaning no regressions for existing callers. The new tests explicitly cover both new code paths, and the normalization regex chain is straightforward and correct.
No files require special attention.

_{Last reviewed commit: 1bc7808}

aisle-research-bot · 2026-04-13T19:22:04Z

🔒 Aisle Security Analysis

We found 2 potential security issue(s) in this PR:

#	Severity	Title
1	🟡 Medium	Ambiguous case-insensitive skill name resolution can select wrong skill and misattribute API-key/config guidance
2	🔵 Low	Prototype manipulation via proto/constructor keys in sanitizeJsonValue Object.fromEntries

1. 🟡 Ambiguous case-insensitive skill name resolution can select wrong skill and misattribute API-key/config guidance

Property	Value
Severity	Medium
CWE	CWE-20
Location	`src/cli/skills-cli.format.ts:121-127`

Description

resolveSkillByName() introduces a case-insensitive fallback that returns the first matching skill without ambiguity detection. If multiple skills differ only by case (or skillKey casing), formatSkillInfo() may display details and API-key/configuration instructions for an unintended skill.

Security impact depends on whether the skill catalog can include attacker-controlled entries (e.g., skills installed into the workspace/managed skills directory from external sources such as a registry):

An attacker-controlled skill can be created with a name/skillKey that differs only by case from a popular legitimate skill.
When the user runs openclaw skills info <name> with different casing, the CLI may resolve to the attacker skill.
formatSkillInfo() prints actionable guidance including a openclaw config set skills.entries.<skillKey>.apiKey ... command and indicates where the API key is stored; this can trick a user into storing a secret under the attacker-controlled skillKey, making it available to that skill’s code later.

Unlike the normalized-match branch, this case-insensitive branch does not check for multiple matches and therefore can silently pick an unintended skill.

Recommendation

Treat case-insensitive matches the same way as normalized matches: collect all matches and require exactly one match.

Example fix:

const lower = raw.toLowerCase();
const ciMatches = report.skills.filter(
  (s) => s.name.toLowerCase() === lower || s.skillKey.toLowerCase() === lower,
);
if (ciMatches.length === 1) return ciMatches[0];
if (ciMatches.length > 1) return null; // or surface an explicit "ambiguous" error listing candidates

Additionally, consider surfacing an "ambiguous skill" error that lists the colliding skill names/keys so the user can disambiguate by using the exact skillKey.

2. 🔵 Prototype manipulation via __proto__/constructor keys in sanitizeJsonValue Object.fromEntries

Property	Value
Severity	Low
CWE	CWE-1321
Location	`src/cli/skills-cli.format.ts:58-69`

Description

sanitizeJsonValue() recursively rebuilds objects using Object.fromEntries(Object.entries(value) ...). If an attacker can supply an object containing special keys like __proto__, prototype, or constructor, Object.fromEntries will invoke the __proto__ setter and change the prototype of the returned object.

Impact in this CLI context:

Can produce surprising behavior during serialization (e.g., JSON.stringify() consults properties like toJSON via prototype lookup).
Creates an unnecessary prototype-manipulation gadget on untrusted data, which is a known class of issues (prototype pollution / prototype manipulation).

Vulnerable code:

return Object.fromEntries(
  Object.entries(value).map(([key, entryValue]) => [key, sanitizeJsonValue(entryValue)]),
);

While this may not pollute Object.prototype globally, it still allows attacker-controlled prototype changes of the produced object and should be avoided when sanitizing untrusted objects.

Recommendation

Avoid Object.fromEntries with untrusted keys and build objects with a null prototype, explicitly rejecting or neutralizing dangerous keys.

Example fix:

const DANGEROUS_KEYS = new Set(["__proto__", "prototype", "constructor"]);

function sanitizeJsonValue(value: unknown): unknown {
  if (typeof value === "string") return sanitizeJsonString(value);
  if (Array.isArray(value)) return value.map(sanitizeJsonValue);
  if (value && typeof value === "object") {
    const out: Record<string, unknown> = Object.create(null);
    for (const [key, entryValue] of Object.entries(value)) {
      if (DANGEROUS_KEYS.has(key)) continue; // or out[`_${key}`] = ...
      out[key] = sanitizeJsonValue(entryValue);
    }
    return out;
  }
  return value;
}

If keys can be user-controlled, consider sanitizing keys as well (e.g., stripping control chars) to prevent downstream confusion.

Analyzed PR: #38713 at commit 132de0e

_{Last updated on: 2026-04-14T02:58:54Z}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 132de0eff6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

openclaw-barnacle · 2026-04-22T04:39:19Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

NewdlDewdl · 2026-04-22T04:46:19Z

Keeping this PR active.\n\nCurrent head status:\n- Existing CI suite on the PR head commit is green\n- Mergeable: yes\n- The only currently pending check is the new auto-response workflow that started after the stale marker\n\nIf you want this refreshed further (rebase/split/follow-up changes), I can do that next.

clawsweeper · 2026-04-26T01:46:37Z

Codex review: passed.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR updates the skills CLI formatter, tests, and changelog so skills info resolves case-insensitive and separator-normalized skill name variants only when non-exact matches are unique, and sanitizes not-found output.

Reproducibility: yes. by source inspection. The documented openclaw skills info <name> command passes the name into an exact-only formatter lookup on current main, while skill status entries can have distinct name and skillKey values.

PR rating
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Summary: Small, well-scoped PR with sufficient terminal proof, focused regression coverage, and no blocking correctness or security findings.

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

PR egg
✨ Hatched: 🥚 common Cosmic Test Hopper

       _..------.._          
    .-'  .-.  .-.  '-.       
   /    ( * )( * )    \      
  |        .--.        |     
  |   <\   ====   />   |     
   \    '.______.'    /      
    '-._   ____   _.-'       
        `-.____.-'           
       __/|_||_|\__          
      /__.'    '.__\         
       .-----------.         
      '-------------'

Rarity: 🥚 common.
Trait: polishes edge cases.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Cosmic Test Hopper in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
How to hatch it: reach status: 👀 ready for maintainer look or status: 🚀 automerge armed; that usually means sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

Real behavior proof
Sufficient (terminal): The PR body includes redacted terminal output from an after-fix local CLI command-path proof showing case-insensitive lookup, separator-normalized lookup, and ambiguous not-found behavior.

Next step before merge
No repair lane is needed; the exact head already has the focused fix, proof, and no blocking review findings, leaving CI and mergeability gates for automerge.

Security
Cleared: The diff is limited to CLI formatter logic, tests, and changelog text; the earlier ambiguous-match concern is fixed on the current head and no dependency, workflow, install, or secret-storage surface is added.

Review details

Best possible solution:

Land the focused formatter and regression-test fix; treat the broader agent activation symptom from the linked report as a separate follow-up only if it still reproduces after this lookup fix.

Do we have a high-confidence way to reproduce the issue?

Yes, by source inspection. The documented openclaw skills info <name> command passes the name into an exact-only formatter lookup on current main, while skill status entries can have distinct name and skillKey values.

Is this the best way to solve the issue?

Yes. The PR keeps exact matches authoritative and only accepts non-exact fallback matches when they are unique, which is narrower and safer than broad fuzzy matching or a new config surface.

Label justifications:

P2: This is a normal-priority user-facing CLI bug fix with limited blast radius in skills lookup and setup guidance.

What I checked:

Current main exact-only lookup: Current main still resolves formatSkillInfo with s.name === skillName || s.skillKey === skillName, so a list-visible skill whose key differs only by case or separators can return not-found. (src/cli/skills-cli.format.ts:186, 1fbb4e4e6a9e)
Command path reaches the formatter: The skills info subcommand passes the user-provided <name> directly into formatSkillInfo, making this formatter lookup the user-facing path. (src/cli/skills-cli.ts:255, 1fbb4e4e6a9e)
Skill status contract supports distinct lookup fields: SkillStatusEntry exposes both name and skillKey as strings, and resolveSkillKey can use metadata.skillKey instead of entry.skill.name, so mismatches between display/list identity and lookup key are a real source-backed state. (src/agents/skills-status.ts:32, 1fbb4e4e6a9e)
PR head adds unique fallback resolution: The PR head adds normalizeSkillLookupToken and resolveSkillByName, keeps exact matches first, and returns null when case-insensitive or normalized fallback matches are ambiguous. (src/cli/skills-cli.format.ts:101, 01f3e2d4680f)
PR head covers the fixed behavior: The PR head adds tests for case-insensitive lookup, separator-variant lookup, ambiguous case-insensitive matches returning not-found, ambiguous normalized matches returning not-found, and sanitized not-found JSON/text output. (src/cli/skills-cli.test.ts:183, 01f3e2d4680f)
Live PR diff matches the reviewed surface: The live PR diff is limited to CHANGELOG.md, src/cli/skills-cli.format.ts, and src/cli/skills-cli.test.ts; it shows the current head adds the unique fallback resolver and changelog entry. (src/cli/skills-cli.format.ts:98, 01f3e2d4680f)

Likely related people:

Peter Steinberger: Current formatSkillInfo and the status formatter files blame to d29f77b, and the skills status management contract traces to cc0075e. (role: introduced current CLI/status surface and recent area contributor; confidence: high; commits: d29f77bece1a, cc0075e9887f; files: src/cli/skills-cli.format.ts, src/cli/skills-cli.ts, src/cli/skills-cli.test.ts)
Tak Hoffman: Recent skills-status work in 5a92655 touched the status report source data that the CLI formatter displays. (role: adjacent area contributor; confidence: medium; commits: 5a92655f5d20; files: src/agents/skills-status.ts)
Vincent Koc: Recent skills runtime work in 8ae6d42 adjusted personal skills loading behavior that feeds the status report. (role: recent adjacent skills runtime contributor; confidence: medium; commits: 8ae6d42faabf; files: src/agents/skills/workspace.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 1fbb4e4e6a9e.

NewdlDewdl · 2026-04-26T16:29:29Z

Thanks, re-verified against current main and this PR head before acting:

Current main (4a3030df9efa) still does exact-only lookup in formatSkillInfo (report.skills.find((s) => s.name === skillName || s.skillKey === skillName)), and main tests still do not cover case-insensitive or separator-variant lookups.
This PR head (132de0eff651) keeps exact match first, adds unique case-insensitive and unique separator-normalized fallback resolution, trims/sanitizes the not-found path, and includes regression tests for Excel-XLSX, excel_xlsx/Excel XLSX, and ambiguous normalized matches.
Current PR state is CLEAN + MERGEABLE, with checks passing.

Keeping #38713 open as the focused fix for #38546.

NewdlDewdl · 2026-04-28T22:32:30Z

Re-verified this against the current refs before acting:

Current main (60861b3823) still does exact-only lookup in formatSkillInfo, so the user-facing mismatch from skills info <name> is still present there.
Current PR head (132de0eff651) is still missing the last ambiguity guard in the case-insensitive fallback. It keeps exact match first, but the case-insensitive branch still returns the first match instead of requiring a unique match.
I applied the narrow follow-up locally in a clean worktree, limited to src/cli/skills-cli.format.ts and src/cli/skills-cli.test.ts, and added a regression that proves ambiguous case-insensitive matches now return not-found instead of selecting the wrong skill.
Verification on that local draft:
- pnpm exec vitest run src/cli/skills-cli.test.ts ✅ (20/20)
- Full local scripts/quality_gate.sh ❌, blocked at unrelated current-tree pnpm tsgo errors outside this PR scope (extensions/discord, extensions/feishu, extensions/nextcloud-talk, extensions/telegram, extensions/whatsapp, src/cron, src/mcp, src/wizard, etc.)

So I have not pushed yet, because I do not want to claim a clean branch gate when the current tree is red for unrelated reasons. Keeping this PR open.

NewdlDewdl · 2026-04-29T00:01:17Z

Rechecked this after the latest clawsweeper follow-up.

Current PR head 132de0eff651 still uses .find() for the case-insensitive fallback in resolveSkillByName(), so ambiguous lowercase collisions can still pick the first match.
I reapplied the focused follow-up locally in a clean worktree, limited to src/cli/skills-cli.format.ts and src/cli/skills-cli.test.ts.
Focused verification passed: pnpm exec vitest run src/cli/skills-cli.test.ts (20/20).
This older PR head does not expose pnpm check:changed locally, and the broader clean-worktree gate is still blocked by unrelated pnpm tsgo errors outside this PR scope (extensions/discord, extensions/feishu, extensions/nextcloud-talk, extensions/telegram, extensions/whatsapp, src/cron, src/mcp, src/wizard).

So I have not pushed yet. Keeping this PR open as the focused fix, with the ambiguity follow-up ready once the broader gate noise is out of the way.

NewdlDewdl · 2026-05-05T00:04:53Z

Addressed the requested PR-branch repair in 502a8e1391.

What changed:

made the case-insensitive fallback in resolveSkillByName() require exactly one match before resolving
added a regression that proves case-only skillKey collisions now return not-found instead of picking the first entry
added the missing changelog line for the user-facing skills info behavior change

Verification:

pnpm test src/cli/skills-cli.test.ts
pnpm test:changed

I also reran the local quality gate in a clean worktree. pnpm install and pnpm build passed, but the full gate still stops at unrelated repo-wide pnpm tsgo failures outside this PR diff (for example extensions/discord, extensions/feishu, extensions/nextcloud-talk, extensions/telegram, extensions/whatsapp, src/cron, src/mcp, src/wizard). I did not change those files, so I pushed the narrow fix and left the full matrix to PR CI on the updated head.

NewdlDewdl · 2026-05-05T01:01:14Z

Rebased onto current main and resolved the merge conflict.

Local verification on the rebased branch:

pnpm test src/cli/skills-cli.test.ts ✅
pnpm check:changed ✅

GitHub now shows the PR as mergeable again, and fresh CI has started on c2345f0277.

NewdlDewdl · 2026-05-05T01:12:19Z

Rechecked the current PR head (c2345f0277) against the edited review before acting.

The changelog bullet is already under ## Unreleased -> ### Fixes on the current branch, not under a shipped release section.
The ambiguity guard is also present on this head: resolveSkillByName() now requires exactly one case-insensitive match before resolving, and returns not-found on collisions.
GitHub currently shows the PR as CLEAN + MERGEABLE, and the current check rollup on c2345f0277 is green.

So there is no additional changelog-placement follow-up left for me to push on top of this head. Keeping the PR ready for merge.

NewdlDewdl · 2026-05-09T21:20:43Z

Added the requested real behavior proof to the PR body.

What changed:

added a redacted terminal proof section for the skills info <name> command path
included outputs for unique case-insensitive lookup, unique separator-normalized lookup, and ambiguous normalized lookup returning not-found
updated the Testing section with the proof command and current PR check rollup

Verification:

pnpm test src/cli/skills-cli.behavior-proof.temp.test.ts --reporter=verbose passed (1/1)
current PR head remains c2345f0277c630531b48de7f33113776dc0787cf
PR check rollup remains green at 93/93 checks

No code changes were needed for this follow-up; this was the missing proof artifact requested by ClawSweeper.

NewdlDewdl · 2026-05-13T03:40:50Z

Re-verified after the 03:32 UTC ClawSweeper/Codex refresh.

No code changes were needed on the branch.

Verification:

PR head remains 01f3e2d4680ff4baaef9d780bc900ef12d01e338.
GitHub reports the PR as CLEAN / MERGEABLE.
gh pr checks shows no failing or pending checks; current jobs are passing with expected skipped/neutral jobs only.
Bot suggestion extraction found 0 actionable Codex/Aisle/Aidle/Greptile suggestions.
The latest ClawSweeper note says the remaining action is maintainer review and merge gating, not automated repair.

This remains ready for maintainer review.

NewdlDewdl · 2026-05-13T05:22:19Z

Re-verified after the 05:19 UTC ClawSweeper/Codex refresh.

No code or PR-body change was needed on the branch.

Verification:

PR head remains 01f3e2d4680ff4baaef9d780bc900ef12d01e338.
GitHub reports the PR as CLEAN / MERGEABLE.
gh pr checks shows no failing or pending checks; current jobs are passing with expected skipped/neutral jobs only.
Bot suggestion extraction found 0 actionable Codex/Aisle/Aidle/Greptile suggestions.
The latest ClawSweeper note says no repair lane is needed and the remaining action is maintainer review / merge gating.

This remains ready for maintainer review.

NewdlDewdl · 2026-05-13T06:40:39Z

Re-verified after the latest ClawSweeper/Codex refresh.

No code or PR-body change was needed on the branch.

Verification:

PR head remains 01f3e2d4680ff4baaef9d780bc900ef12d01e338.
gh pr checks 38713 --repo openclaw/openclaw shows no failing or pending checks; current jobs are pass/skipping only, including Real behavior proof.
Bot suggestion extraction found 0 actionable Codex/Aisle/Aidle/Greptile suggestions.
The refreshed ClawSweeper note says no repair lane is needed and the remaining action is normal maintainer review / merge gating.
Live mergeability is currently UNKNOWN, so I am not claiming a fresh mergeable state from this pass.

This remains ready from the contributor side for maintainer review.

NewdlDewdl · 2026-05-13T15:25:24Z

Re-verified after the 15:10 UTC ClawSweeper/Codex refresh.

No code or PR-body change was needed on the branch.

Verification:

PR head remains 01f3e2d4680ff4baaef9d780bc900ef12d01e338.
GitHub reports the PR as CLEAN / MERGEABLE.
gh pr checks 38713 --repo openclaw/openclaw shows no failing or pending checks; current jobs are passing with expected skipped/neutral jobs only.
Bot suggestion extraction found 0 actionable Codex/Aisle/Aidle/Greptile suggestions.
The refreshed ClawSweeper note says no repair lane is needed and the remaining action is normal maintainer review / merge gating.

This remains ready from the contributor side for maintainer review.

NewdlDewdl · 2026-05-15T01:40:35Z

Thanks for the verification. I re-checked the current PR state and there is nothing to change from my side right now: head 01f3e2d4680f remains open, non-draft, CLEAN/MERGEABLE, and the check rollup is pass/skipping/neutral only.

I will avoid branch churn unless a maintainer with merge permissions asks for a specific change.

Takhoffman · 2026-05-18T16:51:19Z

@clawsweeper automerge

clawsweeper · 2026-05-18T16:53:19Z

🦞✅
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=01f3e2d4680ff4baaef9d780bc900ef12d01e338)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-05-18T17:00:58Z
Merge commit: 9cbe28d75ed9

What merged:

The PR updates the skills CLI formatter, tests, and changelog so skills info resolves case-insensitive and ... ator-normalized skill name variants only when non-exact matches are unique, and sanitizes not-found output.
Reproducibility: yes. by source inspection. The documented openclaw skills info <name> command passes the ... ormatter lookup on current main, while skill status entries can have distinct name and skillKey values.

Automerge notes:

PR branch already contained follow-up commit before automerge: test(skills): exercise case-insensitive lookup branch
PR branch already contained follow-up commit before automerge: style(skills): format lookup resolver signature
PR branch already contained follow-up commit before automerge: fix(skills): sanitize not-found output and avoid ambiguous lookup mat…
PR branch already contained follow-up commit before automerge: fix(skills): require unique case-insensitive info matches

The automerge loop is complete.

Automerge progress:

2026-05-18 16:53:19 UTC review queued 01f3e2d4680f (queued)

2026-05-18 17:00:38 UTC review passed 01f3e2d4680f (structured ClawSweeper verdict: pass (sha=01f3e2d4680ff4baaef9d780bc900ef12d01e...)

2026-05-18 17:01:01 UTC merged 01f3e2d4680f (merged by ClawSweeper automerge)

Summary: - The PR updates the skills CLI formatter, tests, and changelog so `skills info` resolves case-insensitive and ... ator-normalized skill name variants only when non-exact matches are unique, and sanitizes not-found output. - Reproducibility: yes. by source inspection. The documented `openclaw skills info <name>` command passes the ... ormatter lookup on current main, while skill status entries can have distinct `name` and `skillKey` values. Automerge notes: - PR branch already contained follow-up commit before automerge: test(skills): exercise case-insensitive lookup branch - PR branch already contained follow-up commit before automerge: style(skills): format lookup resolver signature - PR branch already contained follow-up commit before automerge: fix(skills): sanitize not-found output and avoid ambiguous lookup mat… - PR branch already contained follow-up commit before automerge: fix(skills): require unique case-insensitive info matches Validation: - ClawSweeper review passed for head 01f3e2d4680ff4baaef9d780bc900ef12d01e338. - Required merge gates passed before the squash merge. Prepared head SHA: 01f3e2d4680ff4baaef9d780bc900ef12d01e338 Review: openclaw/openclaw#38713 (comment) Co-authored-by: NewdlDewdl <rohin.agrawal@gmail.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>

Summary: - The PR updates the skills CLI formatter, tests, and changelog so `skills info` resolves case-insensitive and ... ator-normalized skill name variants only when non-exact matches are unique, and sanitizes not-found output. - Reproducibility: yes. by source inspection. The documented `openclaw skills info <name>` command passes the ... ormatter lookup on current main, while skill status entries can have distinct `name` and `skillKey` values. Automerge notes: - PR branch already contained follow-up commit before automerge: test(skills): exercise case-insensitive lookup branch - PR branch already contained follow-up commit before automerge: style(skills): format lookup resolver signature - PR branch already contained follow-up commit before automerge: fix(skills): sanitize not-found output and avoid ambiguous lookup mat… - PR branch already contained follow-up commit before automerge: fix(skills): require unique case-insensitive info matches Validation: - ClawSweeper review passed for head 01f3e2d. - Required merge gates passed before the squash merge. Prepared head SHA: 01f3e2d Review: openclaw#38713 (comment) Co-authored-by: NewdlDewdl <rohin.agrawal@gmail.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>

NewdlDewdl mentioned this pull request Mar 7, 2026

fix(skills): resolve skills info name mismatches #38701

Closed

openclaw-barnacle Bot added cli CLI command changes size: S labels Mar 7, 2026

NewdlDewdl force-pushed the fix/issue-38546-skills-info-lookup branch from f2aa660 to 749928c Compare March 14, 2026 23:20

NewdlDewdl force-pushed the fix/issue-38546-skills-info-lookup branch from 749928c to 1dbe490 Compare April 13, 2026 19:21

chatgpt-codex-connector Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread src/cli/skills-cli.format.ts Outdated

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Apr 22, 2026

openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Apr 23, 2026

clawsweeper Bot mentioned this pull request Apr 26, 2026

Title: Skills show as "ready" in list but "not found" in info, and can't be used by agent Steps to reproduce: #38546

Closed

NewdlDewdl force-pushed the fix/issue-38546-skills-info-lookup branch from 502a8e1 to c2345f0 Compare May 5, 2026 01:00

openclaw-barnacle Bot added the triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. label May 9, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 9, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 9, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 9, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 9, 2026

NewdlDewdl force-pushed the fix/issue-38546-skills-info-lookup branch from c2345f0 to 7bf36e0 Compare May 9, 2026 22:29

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 9, 2026

clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label May 18, 2026

clawsweeper Bot added status: 🚀 automerge armed This PR is in ClawSweeper's automerge lane. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 18, 2026

clawsweeper Bot merged commit 9cbe28d into openclaw:main May 18, 2026
194 of 200 checks passed

github-actions Bot mentioned this pull request May 18, 2026

📡 Upstream Digest — 2026-05-18 17:53 UTC curtismercier/openclaw-mods#891

Open

Uh oh!

Conversation

NewdlDewdl commented Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Real behavior proof

Testing

AI-assisted disclosure

Uh oh!

greptile-apps Bot commented Mar 7, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

aisle-research-bot Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Aisle Security Analysis

Description

Recommendation

Description

Recommendation

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

openclaw-barnacle Bot commented Apr 22, 2026

Uh oh!

NewdlDewdl commented Apr 22, 2026

Uh oh!

clawsweeper Bot commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NewdlDewdl commented Apr 26, 2026

Uh oh!

NewdlDewdl commented Apr 28, 2026

Uh oh!

NewdlDewdl commented Apr 29, 2026

Uh oh!

NewdlDewdl commented May 5, 2026

Uh oh!

NewdlDewdl commented May 5, 2026

Uh oh!

NewdlDewdl commented May 5, 2026

Uh oh!

NewdlDewdl commented May 9, 2026

Uh oh!

NewdlDewdl commented May 13, 2026

Uh oh!

NewdlDewdl commented May 13, 2026

Uh oh!

NewdlDewdl commented May 13, 2026

Uh oh!

NewdlDewdl commented May 13, 2026

Uh oh!

NewdlDewdl commented May 15, 2026

Uh oh!

Takhoffman commented May 18, 2026

Uh oh!

clawsweeper Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

NewdlDewdl commented Mar 7, 2026 •

edited

Loading

aisle-research-bot Bot commented Apr 13, 2026 •

edited

Loading

clawsweeper Bot commented Apr 26, 2026 •

edited

Loading

clawsweeper Bot commented May 18, 2026 •

edited

Loading