fix(skills): keep blank env requirements unsatisfied (#108848)

wahaha1223 · steipete · web-flow · commit d1e2fbd6823e · 2026-07-16T08:37:35.000-07:00
* fix(skills): keep blank env requirements unsatisfied

* refactor(skills): reuse secret input presence check

---------

Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/src/skills/discovery/status.test.ts b/src/skills/discovery/status.test.ts
@@ -13,6 +13,30 @@ type SkillStatus = ReturnType<typeof buildWorkspaceSkillStatus>["skills"][number
 const tempDirs = useAutoCleanupTempDirTracker(afterEach);
 
 describe("buildWorkspaceSkillStatus", () => {
+  it("reports blank env requirements as missing", () => {
+    const envName = "OPENCLAW_TEST_BLANK_SKILL_STATUS";
+    const original = process.env[envName];
+    process.env[envName] = "   ";
+    try {
+      const report = buildWorkspaceSkillStatus("/tmp/ws", {
+        entries: [
+          createEntry("blank-env", {
+            metadata: { primaryEnv: envName, requires: { env: [envName] } },
+          }),
+        ],
+      });
+
+      expect(report.skills[0]?.eligible).toBe(false);
+      expect(report.skills[0]?.missing.env).toEqual([envName]);
+    } finally {
+      if (original === undefined) {
+        delete process.env[envName];
+      } else {
+        process.env[envName] = original;
+      }
+    }
+  });
+
   it("surfaces valid ClawHub linkage and local Skill Card metadata", async () => {
     const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-skill-status-"));
     try {
diff --git a/src/skills/discovery/status.ts b/src/skills/discovery/status.ts
@@ -16,6 +16,7 @@ import { resolveBundledSkillsContext } from "../loading/bundled-context.js";
 import {
   hasBinary,
   isBundledSkillAllowed,
+  isSkillEnvRequirementSatisfied,
   isSkillConfigPathTruthy,
   resolveBundledAllowlist,
   resolveSkillConfig,
@@ -269,11 +270,11 @@ function buildSkillStatus(
   const blockedByAgentFilter = agentSkillFilter !== undefined && !indexed.agentAllowed;
   const always = entry.metadata?.always === true;
   const isEnvSatisfied = (envName: string) =>
-    Boolean(
-      process.env[envName] ||
-      skillConfig?.env?.[envName] ||
-      (skillConfig?.apiKey && entry.metadata?.primaryEnv === envName),
-    );
+    isSkillEnvRequirementSatisfied({
+      envName,
+      skillConfig,
+      primaryEnv: entry.metadata?.primaryEnv,
+    });
   const isConfigSatisfied = (pathStr: string) => isSkillConfigPathTruthy(config, pathStr);
   const skillSource = indexed.source;
   const bundled = indexed.bundled;
diff --git a/src/skills/loading/config.ts b/src/skills/loading/config.ts
@@ -5,6 +5,7 @@ import {
 } from "@openclaw/normalization-core/string-coerce";
 import { normalizeStringEntries } from "@openclaw/normalization-core/string-normalization";
 import type { OpenClawConfig } from "../../config/types.openclaw.js";
+import { hasConfiguredSecretInput } from "../../config/types.secrets.js";
 import type { SkillConfig } from "../../config/types.skills.js";
 import {
   evaluateRuntimeEligibility,
@@ -56,6 +57,19 @@ export function resolveSkillConfig(
   return entry;
 }
 
+export function isSkillEnvRequirementSatisfied(params: {
+  envName: string;
+  skillConfig?: SkillConfig;
+  primaryEnv?: string;
+}): boolean {
+  const { envName, skillConfig, primaryEnv } = params;
+  return (
+    normalizeOptionalString(process.env[envName]) !== undefined ||
+    normalizeOptionalString(skillConfig?.env?.[envName]) !== undefined ||
+    (primaryEnv === envName && hasConfiguredSecretInput(skillConfig?.apiKey))
+  );
+}
+
 function normalizeAllowlist(input: unknown): ReadonlySet<string> | undefined {
   if (!input) {
     return undefined;
@@ -113,11 +127,11 @@ export function shouldIncludeSkill(params: {
     hasRemoteBin: eligibility?.remote?.hasBin,
     hasAnyRemoteBin: eligibility?.remote?.hasAnyBin,
     hasEnv: (envName) =>
-      Boolean(
-        process.env[envName] ||
-        skillConfig?.env?.[envName] ||
-        (skillConfig?.apiKey && entry.metadata?.primaryEnv === envName),
-      ),
+      isSkillEnvRequirementSatisfied({
+        envName,
+        skillConfig,
+        primaryEnv: entry.metadata?.primaryEnv,
+      }),
     isConfigPathTruthy: (configPath) => isSkillConfigPathTruthy(config, configPath),
   });
 }
diff --git a/src/skills/loading/skills.test.ts b/src/skills/loading/skills.test.ts
@@ -24,6 +24,7 @@ import {
   type SkillsHomeEnvSnapshot,
 } from "../test-support/home-env.test-support.js";
 import type { SkillEntry, SkillSnapshot } from "../types.js";
+import { shouldIncludeSkill } from "./config.js";
 import { buildWorkspaceSkillsPrompt } from "./workspace.js";
 
 vi.mock("./plugin-skills.js", () => ({
@@ -502,6 +503,62 @@ describe("buildWorkspaceSkillsPrompt", () => {
   });
 });
 
+describe("shouldIncludeSkill", () => {
+  const envName = "OPENCLAW_TEST_SKILL_REQUIREMENT";
+  const entry = makeSkillEntry("env-skill", {
+    primaryEnv: envName,
+    requires: { env: [envName] },
+  });
+
+  function shouldInclude(config?: OpenClawConfig): boolean {
+    return shouldIncludeSkill({ entry, config, bundledAllowlist: undefined });
+  }
+
+  it("requires non-blank host and configured env values", () => {
+    withClearedEnv([envName], () => {
+      expect(shouldInclude()).toBe(false);
+
+      process.env[envName] = "   ";
+      expect(shouldInclude()).toBe(false);
+
+      process.env[envName] = " example ";
+      expect(shouldInclude()).toBe(true);
+
+      delete process.env[envName];
+      expect(
+        shouldInclude({ skills: { entries: { "env-skill": { env: { [envName]: "   " } } } } }),
+      ).toBe(false);
+      expect(
+        shouldInclude({
+          skills: { entries: { "env-skill": { env: { [envName]: " example " } } } },
+        }),
+      ).toBe(true);
+    });
+  });
+
+  it("requires a non-blank primary apiKey", () => {
+    withClearedEnv([envName], () => {
+      expect(shouldInclude(resolvedSkillApiKeyConfig("env-skill", "   "))).toBe(false);
+      expect(shouldInclude(resolvedSkillApiKeyConfig("env-skill", " example "))).toBe(true);
+      expect(shouldInclude(rawSkillApiKeyRefConfig("env-skill"))).toBe(true);
+    });
+  });
+
+  it("keeps always-on skills eligible without credentials", () => {
+    withClearedEnv([envName], () => {
+      expect(
+        shouldIncludeSkill({
+          entry: makeSkillEntry("always-skill", {
+            always: true,
+            requires: { env: [envName] },
+          }),
+          bundledAllowlist: undefined,
+        }),
+      ).toBe(true);
+    });
+  });
+});
+
 describe("applySkillEnvOverrides", () => {
   it("sets and restores env vars", () => {
     const entries = envSkillEntries("env-skill", {
