fix(skills): correct invalid install kinds in xurl and github [AI] by not-stbenjam · Pull Request #102158 · openclaw/openclaw

not-stbenjam · 2026-07-08T11:34:44Z

Related: #57555
Related: steipete/agent-scripts#27

What Problem This Solves

Fixes an issue where users installing the xurl or github skills through
openclaw would be offered no working (or a misleading) install option,
because the skill metadata declares an install kind openclaw doesn't
support and silently drops.

xurl: its npm installer is declared kind: "npm". npm is not a
supported kind, so openclaw skills info xurl never offers it — on a
machine without Homebrew, xurl has no install path at all.
github: its second installer is declared kind: "apt", also
unsupported, so it never appears — dead, misleading metadata implying a
Linux-native path that never runs.

Found via skillsaw's
openclaw-metadata rule.

Why This Change Was Made

The installer resolves spec.kind against brew/node/go/uv/download
(src/skills/lifecycle/install.ts), with a default: "unsupported installer";
src/skills/types.ts is the authoritative union. Anything else is dropped.

xurl: npm isn't a kind — it's the default skills.install.nodeManager.
npm-backed installs use kind: "node" with a package field, so this
changes only kind (id/package/bins unchanged).
github: there is no supported system-package kind to convert apt to,
and the existing brew installer is already cross-platform (Homebrew runs
on Linux), so the dead entry is removed rather than rewritten. Improving
install paths for Linux users without Homebrew is a separate product
decision, tracked in Built-in skill 'summarize' only supports brew install, no feedback when enable fails #57555 — explicitly out of scope here.

User Impact

openclaw skills info xurl now offers a working npm install
(npm install -g @xdevplatform/xurl) on any system with a node manager,
not just Homebrew hosts.
github install options are now honest: only the installer that actually
runs (brew, cross-platform) is shown. No functional path is lost.

Evidence

Verified against openclaw 2026.6.11 in a throwaway container by copying the
edited skills over the bundled copies and running openclaw skills info.

xurl — before (kind: "npm"): npm installer dropped; only brew offered.
xurl — after (kind: "node"):

"install": [
  { "id": "npm", "kind": "node", "label": "Install @xdevplatform/xurl (npm)", "bins": ["xurl"] }
]

github — before: apt entry dropped; only brew offered (identical to
after — confirming the apt entry was already dead).
github — after (apt removed): parses cleanly, brew installer intact:

"install": [
  { "id": "brew", "kind": "brew", "label": "Install GitHub CLI (brew)", "bins": ["gh"] }
]

AI-assisted.

The xurl skill's second installer declares kind "npm", which is not a valid install kind. The installer switches on spec.kind with cases for brew/node/go/uv/download and a default of "unsupported installer", so the entry is dropped -- `openclaw skills info xurl` only offers the brew option, leaving no install path on machines without Homebrew. npm-backed installs use kind "node" (which honors skills.install.nodeManager, default npm). Only kind is changed; id/package/bins are left as-is. Verified against openclaw 2026.6.11 in a container: before (kind: npm): Install options: → Install xurl (brew) after (kind: node): Install options: → Install @xdevplatform/xurl (npm)

The github skill's second installer declares kind "apt", which is not a supported install kind (installer switch handles brew/node/go/uv/download + default "unsupported installer"). openclaw silently drops it -- `skills info github` only ever surfaces the brew option -- so the entry is dead, misleading metadata rather than a working Linux path. The remaining brew installer is cross-platform (Homebrew runs on Linux), so removing the dead entry loses no working path. Improving install paths for Linux users without Homebrew is tracked separately in openclaw#57555 (needs-product-decision).

clawsweeper · 2026-07-08T11:35:55Z

Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 7:51 AM ET / 11:51 UTC.

Summary
The PR changes skills/xurl/SKILL.md to use the supported node install kind and removes the unsupported apt installer from skills/github/SKILL.md.

PR surface: Docs -7. Total -7 across 2 files.

Reproducibility: yes. source-reproducible: current main and v2026.6.11 declare xurl kind npm and github kind apt, while the parser and type contract accept only brew, node, go, uv, and download. The contributor also included copied before/after openclaw skills info output from a throwaway container.

Review metrics: 1 noteworthy metric.

Bundled installer metadata: 1 install kind changed, 1 unsupported entry removed. This changes which install options skills info can surface for two bundled skills.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Next step before merge

[P2] No repair job is needed because the PR is narrow, proof is sufficient, and there are no review findings for automation to fix.

Security
Cleared: No concrete security or supply-chain regression found: the PR changes only bundled SKILL.md metadata, adds no dependency/workflow/script source, and the now-supported xurl package spec was already present.

Review details

Best possible solution:

Merge the narrow metadata correction after normal maintainer checks; keep broader non-brew Linux installer expansion in #57555.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main and v2026.6.11 declare xurl kind npm and github kind apt, while the parser and type contract accept only brew, node, go, uv, and download. The contributor also included copied before/after openclaw skills info output from a throwaway container.

Is this the best way to solve the issue?

Yes. For this scoped bug, aligning xurl with the existing node installer contract and removing github's unsupported dead apt entry is narrower than adding a new package-manager kind or solving the broader Linux installer product question here.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 58891c85b68b.

Label changes

Label justifications:

P2: The PR fixes broken bundled-skill install metadata with limited blast radius to xurl and github setup output.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes copied throwaway-container before/after openclaw skills info output for both changed skills, which directly shows the changed CLI metadata behavior.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes copied throwaway-container before/after openclaw skills info output for both changed skills, which directly shows the changed CLI metadata behavior.

Evidence reviewed

PR surface:

Docs -7. Total -7 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	0	0	0	0
Docs	2	1	8	-7
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	1	8	-7

What I checked:

Repository policy read: Root AGENTS.md was read fully and applied; find found no scoped AGENTS.md under skills/, so root review policy governs the touched files. (AGENTS.md:1, 58891c85b68b)
Skill install-kind contract: SkillInstallSpec.kind accepts only brew, node, go, uv, and download, so npm and apt are not valid skill install kinds. (src/skills/types.ts:6, 58891c85b68b)
Unsupported install entries are filtered: Skill frontmatter parsing passes only brew, node, go, uv, and download to the shared install parser; unsupported kinds return undefined and are filtered out. (src/skills/loading/frontmatter.ts:114, 58891c85b68b)
Current main still has invalid metadata: Current main declares xurl with kind: "npm" and github with kind: "apt"; targeted search found those as the only skill metadata hits for those invalid install kinds. (skills/xurl/SKILL.md:21, 58891c85b68b)
PR head fixes the metadata shape: At the PR head, xurl uses kind: "node" while preserving id/package/bins, and github retains only the existing brew installer. (skills/xurl/SKILL.md:21, 7f2a5144d366)
Latest release still affected: v2026.6.11 contains the same xurl npm and github apt metadata while the release type contract still excludes both kinds. (skills/xurl/SKILL.md:21, e085fa1a3ffd)

Likely related people:

Santiago Medina Rolong: Older all-branch history shows Santiago Medina Rolong adding and updating the xurl skill metadata that included the npm installer entry before later carry-forward commits. (role: introduced xurl skill metadata; confidence: high; commits: 635b6298e33b, ac2ef69454e6, da844d6411b4; files: skills/xurl/SKILL.md)
Shadow: Commit a21671e added the github skill dependency metadata and install hints, including the unsupported apt entry. (role: introduced github install metadata; confidence: high; commits: a21671ed5b3f; files: skills/github/SKILL.md)
jackheuberger: The github install metadata commit credits jackheuberger as co-author, and the associated closed PR body described adding github brew/apt install hints. (role: co-author of github metadata change; confidence: medium; commits: a21671ed5b3f; files: skills/github/SKILL.md)
Wynne668: Current line blame for both touched SKILL.md files is the recent carry-forward commit that added the files to the current path. (role: recent area contributor; confidence: medium; commits: 6db0506474ce; files: skills/xurl/SKILL.md, skills/github/SKILL.md)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-07-08T11:41:25.338Z sha 7f2a514 :: needs maintainer review before merge. :: none

sallyom · 2026-07-08T15:04:22Z

Maintainer review: merge-ready at head SHA: 7f2a514

The patch is the best narrow fix for the scoped metadata bug: xurl keeps the existing id: "npm" selector and only changes the unsupported install kind to OpenClaw's supported node installer, while github drops a dead apt entry that OpenClaw never executed. CI is clean, the submitted behavior proof matches the installer contract, and I do not see a breaking-change or compatibility concern.

The related follow-ups should stay separate: #57555 for summarize, and steipete/agent-scripts#27 should update the upstream xurl copy so this metadata does not drift back.

sallyom · 2026-07-08T15:11:16Z

Thanks for the contribution, @not-stbenjam and for your first OpenClaw PR! A clean fix with useful behavior proof 😁

…penclaw#102158) * fix(xurl): use install kind "node" instead of invalid "npm" [AI] The xurl skill's second installer declares kind "npm", which is not a valid install kind. The installer switches on spec.kind with cases for brew/node/go/uv/download and a default of "unsupported installer", so the entry is dropped -- `openclaw skills info xurl` only offers the brew option, leaving no install path on machines without Homebrew. npm-backed installs use kind "node" (which honors skills.install.nodeManager, default npm). Only kind is changed; id/package/bins are left as-is. Verified against openclaw 2026.6.11 in a container: before (kind: npm): Install options: → Install xurl (brew) after (kind: node): Install options: → Install @xdevplatform/xurl (npm) * fix(github): drop non-functional "apt" install entry [AI] The github skill's second installer declares kind "apt", which is not a supported install kind (installer switch handles brew/node/go/uv/download + default "unsupported installer"). openclaw silently drops it -- `skills info github` only ever surfaces the brew option -- so the entry is dead, misleading metadata rather than a working Linux path. The remaining brew installer is cross-platform (Homebrew runs on Linux), so removing the dead entry loses no working path. Improving install paths for Linux users without Homebrew is tracked separately in openclaw#57555 (needs-product-decision).

not-stbenjam added 2 commits July 8, 2026 07:23

openclaw-barnacle Bot added the size: XS label Jul 8, 2026

not-stbenjam mentioned this pull request Jul 8, 2026

fix(xurl): use install kind "node" instead of invalid "npm" steipete/agent-scripts#27

Merged

openclaw-barnacle Bot added the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 8, 2026

openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 8, 2026

sallyom assigned steipete and sallyom and unassigned steipete Jul 8, 2026

sallyom merged commit c69724e into openclaw:main Jul 8, 2026
92 of 103 checks passed

github-actions Bot mentioned this pull request Jul 8, 2026

📡 Upstream Digest — 2026-07-08 15:57 UTC curtismercier/openclaw-mods#1239

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(skills): correct invalid install kinds in xurl and github [AI]#102158

fix(skills): correct invalid install kinds in xurl and github [AI]#102158
sallyom merged 2 commits into
openclaw:mainfrom
not-stbenjam:fix/bundled-skill-install-kinds

not-stbenjam commented Jul 8, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

sallyom commented Jul 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

sallyom commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

not-stbenjam commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sallyom commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

sallyom commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

not-stbenjam commented Jul 8, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

sallyom commented Jul 8, 2026 •

edited

Loading