fix(xurl): use install kind "node" instead of invalid "npm" by not-stbenjam · Pull Request #27 · steipete/agent-scripts

not-stbenjam · 2026-07-08T11:06:16Z

Trivial fix that skillsaw caught. It triggered the
openclaw-metadata rule:

⚠ WARNING (openclaw-metadata) [skills/xurl/SKILL.md:21]:
'metadata.openclaw.install[1].kind' is 'npm', expected one of:
['brew', 'download', 'go', 'node', 'uv']

npm isn't a valid install kind — it's a value of the
skills.install.nodeManager setting (npm/pnpm/yarn/bun), which the
node kind honors. npm-based installs use kind: "node" with a package
field, so this changes only kind (id/package/bins are left as-is).

             {
               "id": "npm",
-              "kind": "npm",
+              "kind": "node",
               "package": "@xdevplatform/xurl",
               "bins": ["xurl"],
               "label": "Install xurl (npm)",
             },

Real-behavior proof (openclaw 2026.6.11, throwaway container)

Ran openclaw's own skills info against the bundled xurl skill, toggling
only the second installer's kind. Notably the published package already
ships kind: "npm", so this reproduces against the shipped metadata.

Before — kind: "npm" (as shipped): openclaw drops the installer as an
unsupported kind. The npm option never appears — only brew is offered, so
xurl is uninstallable via openclaw on any machine without Homebrew:

$ openclaw skills info xurl
Install options:
  → Install xurl (brew)

"install": [
  { "id": "brew", "kind": "brew", "label": "Install xurl (brew)", "bins": ["xurl"] }
]

After — kind: "node" (this PR): openclaw resolves the installer and
surfaces the npm option:

$ openclaw skills info xurl
Install options:
  → Install @xdevplatform/xurl (npm)

"install": [
  { "id": "npm", "kind": "node", "label": "Install @xdevplatform/xurl (npm)", "bins": ["xurl"] }
]

The id: "npm" selector is preserved (kept from the original), so this
isn't a compatibility change — only the invalid kind is corrected.

Refs: https://docs.openclaw.ai/tools/skills

clawsweeper · 2026-07-08T11:07:07Z

Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 7:24 AM ET / 11:24 UTC.

Summary
The PR changes the xurl skill's npm install entry from invalid kind: "npm" to OpenClaw's node install kind while preserving the npm install id.

Reproducibility: yes. source inspection shows current main uses unsupported kind: "npm" for the xurl npm installer, and the PR body provides a before/after openclaw skills info xurl transcript. I did not rerun OpenClaw locally in this read-only review.

Review metrics: 2 noteworthy metrics.

Skill metadata diff: 1 file changed, 1 insertion, 1 deletion. The entire patch is a single installer metadata correction for one bundled skill.
Prior findings: 1 rechecked, 0 remain. The current head preserved the npm install id and added runtime proof, resolving the previous review blocker.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Next step before merge

[P2] No repair lane is needed; the contributor force-push resolved the prior blocker, and the remaining action is ordinary maintainer review or merge.

Security
Cleared: No concrete security or supply-chain concern found; the patch activates the existing declared npm package through OpenClaw's documented node installer kind and adds no new dependency source.

Review details

Best possible solution:

Merge the narrow metadata fix after normal maintainer checks, preserving id: "npm" while using kind: "node".

Do we have a high-confidence way to reproduce the issue?

Yes, source inspection shows current main uses unsupported kind: "npm" for the xurl npm installer, and the PR body provides a before/after openclaw skills info xurl transcript. I did not rerun OpenClaw locally in this read-only review.

Is this the best way to solve the issue?

Yes, changing only the install kind to node while preserving the existing npm id/package/bins is the narrowest maintainable fix for the metadata contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 0b3e10b735ad.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The PR body now includes after-fix terminal proof showing the corrected xurl npm install option appears in openclaw skills info xurl.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body now includes after-fix terminal proof showing the corrected xurl npm install option appears in openclaw skills info xurl.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.

Label justifications:

P2: This is a normal-priority skill install metadata bug with limited blast radius to the xurl install option.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body now includes after-fix terminal proof showing the corrected xurl npm install option appears in openclaw skills info xurl.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body now includes after-fix terminal proof showing the corrected xurl npm install option appears in openclaw skills info xurl.

Evidence reviewed

What I checked:

Current main has the invalid installer kind: Current main declares the xurl npm installer with id: "npm" and kind: "npm", matching the reported metadata bug. (skills/xurl/SKILL.md:20, 0b3e10b735ad)
Current PR head makes the narrow metadata change: At PR head, the same install entry keeps id: "npm" and changes only kind to node, while leaving package, bins, and label intact. (skills/xurl/SKILL.md:20, fc04b99d5087)
Prior ClawSweeper blocker was fixed: The diff from the earlier reviewed SHA to current head changes the install id back from node to npm, so the prior compatibility finding no longer applies. (skills/xurl/SKILL.md:20, fc04b99d5087)
Installer-kind contract matches the patch: The public OpenClaw macOS skill docs describe metadata.openclaw.install options as brew, node, go, uv, and download, and mention node-manager preference for node-backed installs. (docs.openclaw.ai)
Real behavior proof is now present: The PR body includes a before/after terminal transcript for openclaw skills info xurl, showing the npm option absent with kind: "npm" and present after changing it to kind: "node". (fc04b99d5087)
Feature history: Git blame and log show the xurl skill metadata, including the original invalid npm kind, was introduced in commit 789e05a by Peter Steinberger. (skills/xurl/SKILL.md:20, 789e05a7c434)

Likely related people:

steipete: Git blame and git log --follow show Peter Steinberger introduced the xurl skill metadata and is the only local history contributor across skills/xurl/SKILL.md and the skills tree sample inspected. (role: feature history owner; confidence: high; commits: 789e05a7c434, 0b3e10b735ad; files: skills/xurl/SKILL.md, skills)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-07-08T11:10:28.707Z sha 070bff9 :: needs real behavior proof before merge. :: [P2] Preserve the existing npm install id

not-stbenjam · 2026-07-08T11:34:53Z

Companion fix upstream in openclaw/openclaw#102158 — same xurl kind: "npm" → "node" change against openclaw's bundled copy of this skill (the copy users actually execute), plus removal of a separate dead kind: "apt" entry in the github skill. The two xurl copies are byte-identical, so both need the change.

rajpratham1

LGTM.

This change corrects the install configuration by replacing the invalid kind: "npm" with the supported kind: "node" while leaving the package, binary, and label unchanged.

Why this is good:

Fixes an invalid installer configuration.
Keeps the existing npm package installation behavior intact.
Small, focused change with very low regression risk.
Improves compatibility with the expected install schema.

Approving.

skillsaw caught this via the openclaw-metadata rule: WARNING (openclaw-metadata) [skills/xurl/SKILL.md:21]: 'metadata.openclaw.install[1].kind' is 'npm', expected one of: ['brew', 'download', 'go', 'node', 'uv'] npm is not a valid install kind -- it's a value of the skills.install.nodeManager setting (npm/pnpm/yarn/bun), which the "node" kind honors. npm-based installs use kind: node with a "package" field. openclaw's installer switches on spec.kind with cases for brew/node/go/uv/download and a default of "unsupported installer", so a kind: npm entry is dropped. Only kind is changed; id/package/bins are left as-is. Refs: https://docs.openclaw.ai/tools/skills

steipete · 2026-07-11T23:21:24Z

Maintainer proof for exact candidate 73321914f370d0df927c21b619ab023836ef2704 on base 93388bf18e8ce8ef58580aff45acc7ebe143d49e:

scripts/validate-skills: 66 skills validated.
xurl YAML/frontmatter parse: valid; npm selector preserved; installer kind is node.
Skillsaw 0.16.0 openclaw-metadata: zero errors or warnings.
Live OpenClaw 2026.6.11 Linux discovery proof remains exact: the candidate xurl skill blob is byte-identical to the previously exercised blob; before the fix only brew was surfaced, while the candidate surfaces the npm installer through the supported Node kind.
git diff --check: passed.
AutoReview against current origin/main: clean, zero accepted/actionable findings, correctness confidence 0.99.
Public Model Identifier Gate: PASS. Candidate diff, changed skill metadata, commit messages, existing public PR discussion, validation output, and this proof text contain no model identifiers requiring publication review.

Risk: low. This changes one invalid metadata value and adds maintainer changelog credit; no dependency source or runtime code changes.

steipete

Maintainer review at exact head 73321914f370d0df927c21b619ab023836ef2704: metadata contract, frontmatter validation, live discovery proof, changelog credit, security check, and model-identifier gate are all clean. Approved for squash merge.

steipete · 2026-07-11T23:33:15Z

Landed as 5c6abe6. Thank you, @not-stbenjam.

Verification:

scripts/validate-skills: 66 skills validated.
xurl YAML/frontmatter and Skillsaw metadata validation passed.
OpenClaw 2026.6.11 Linux discovery proof confirmed the npm installer is surfaced through the supported Node kind.
AutoReview: clean; no accepted/actionable findings.
Exact-head GitGuardian check: passed.
Post-merge CI: https://github.com/steipete/agent-scripts/actions/runs/29172029683 — smoke passed.
Public Model Identifier Gate: PASS.

No remaining caveats.

not-stbenjam force-pushed the fix/xurl-install-kind-node branch from 070bff9 to fc04b99 Compare July 8, 2026 11:20

not-stbenjam mentioned this pull request Jul 8, 2026

fix(skills): correct invalid install kinds in xurl and github [AI] openclaw/openclaw#102158

Merged

rajpratham1 approved these changes Jul 9, 2026

View reviewed changes

not-stbenjam and others added 2 commits July 11, 2026 16:19

docs: credit xurl installer fix

7332191

steipete force-pushed the fix/xurl-install-kind-node branch from fc04b99 to 7332191 Compare July 11, 2026 23:21

steipete approved these changes Jul 11, 2026

View reviewed changes

steipete merged commit 5c6abe6 into steipete:main Jul 11, 2026
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(xurl): use install kind "node" instead of invalid "npm"#27

fix(xurl): use install kind "node" instead of invalid "npm"#27
steipete merged 2 commits into
steipete:mainfrom
not-stbenjam:fix/xurl-install-kind-node

not-stbenjam commented Jul 8, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

not-stbenjam commented Jul 8, 2026

Uh oh!

rajpratham1 left a comment

Uh oh!

steipete commented Jul 11, 2026

Uh oh!

steipete left a comment

Uh oh!

Uh oh!

steipete commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

not-stbenjam commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Real-behavior proof (openclaw 2026.6.11, throwaway container)

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

not-stbenjam commented Jul 8, 2026

Uh oh!

rajpratham1 left a comment

Choose a reason for hiding this comment

Uh oh!

steipete commented Jul 11, 2026

Uh oh!

steipete left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

steipete commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

not-stbenjam commented Jul 8, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading