fix(claws): drop primaryEnv from sageox skills, require claude bin#517
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThe PR refactors OpenClaw skill authentication from per-skill Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@claws/openclaw/sageox-summary/SKILL.md`:
- Around line 64-67: The auth docs incorrectly state that ANTHROPIC_API_KEY in
the launching shell reaches the skill subprocess; update the SKILL.md text
around the `claude -p` description to instead document `claude login` as the
guaranteed in-skill path (the OAuth session under `~/.claude/`), and add a note
that while `ANTHROPIC_API_KEY` in `~/.openclaw/.env` or the launching shell can
authenticate the OpenClaw daemon/launcher, the `ox` daemon sanitizes adapter
environments (patterns matching KEY/SECRET/TOKEN/PASSWORD and even
`required_env` entries), so those variables do not propagate into the skill
process. Ensure the same replacement is applied to the duplicate blocks
previously at the other two locations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 936ec7fc-d9ce-43b4-84d3-946d9f1554f3
📒 Files selected for processing (10)
claws/openclaw/PUBLISHING.mdclaws/openclaw/README.mdclaws/openclaw/sageox-distill/README.mdclaws/openclaw/sageox-distill/SKILL.mdclaws/openclaw/sageox-distill/references/INSTALL.mdclaws/openclaw/sageox-distill/scripts/install-ox-git.shclaws/openclaw/sageox-summary/README.mdclaws/openclaw/sageox-summary/SKILL.mdclaws/openclaw/sageox-summary/references/INSTALL.mdclaws/openclaw/sageox-summary/scripts/install-ox-git.sh
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-Authored-By: SageOx <ox@sageox.ai> SageOx-Session: https://sageox.ai/repo/repo_019c5812-01e9-7b7d-b5b1-321c471c9777/sessions/2026-04-15T05-15-galexy-Ox1o1I/view
galexy
force-pushed
the
galex/claws-sageox-frontmatter
branch
from
f874a36 to
3830ca5
Compare
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
claws/openclaw/sageox-summary/SKILL.md (1)
64-67:⚠️ Potential issue | 🟠 MajorAuth guidance still claims shell
ANTHROPIC_API_KEYreaches the skill subprocess.This repeats the previously flagged env-sanitization mismatch. Please update this block to treat
claude loginas the guaranteed in-skill path, and clarify that shell-exportedANTHROPIC_API_KEYmay authenticate launcher/host context but is not guaranteed to propagate into the skill process.
Downstream duplicate wording at Line 327–Line 330 should be updated in the same way.Suggested doc patch
-`claude -p` will use whatever credentials `claude` already has — either -an OAuth session from `claude login` (Pro/Max subscription) or -`ANTHROPIC_API_KEY` exported in the shell that launched OpenClaw. The -skill no longer accepts a per-skill `apiKey`. +`claude -p` should be treated as requiring credentials already available +to the `claude` CLI inside the skill process. The guaranteed path is an +OAuth session from `claude login` (Pro/Max subscription). The skill no +longer accepts a per-skill `apiKey`.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@claws/openclaw/sageox-summary/SKILL.md` around lines 64 - 67, Update the documentation block in SKILL.md (the paragraph starting with "`claude -p` will use whatever credentials `claude` already has") to state that "claude login" is the guaranteed in-skill authentication path and that a shell-exported ANTHROPIC_API_KEY may authenticate the launcher/host context but is not guaranteed to propagate into the skill subprocess; also remove or clarify the sentence about the skill no longer accepting a per-skill `apiKey`. Apply the same change to the duplicate wording around the later block referenced (the content currently at lines showing the duplicate wording, originally Lines 327–330) so both places explicitly distinguish guaranteed in-skill auth via `claude login` vs. unreliable propagation of an environment ANTHROPIC_API_KEY.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@claws/openclaw/sageox-summary/SKILL.md`:
- Around line 64-67: Update the documentation block in SKILL.md (the paragraph
starting with "`claude -p` will use whatever credentials `claude` already has")
to state that "claude login" is the guaranteed in-skill authentication path and
that a shell-exported ANTHROPIC_API_KEY may authenticate the launcher/host
context but is not guaranteed to propagate into the skill subprocess; also
remove or clarify the sentence about the skill no longer accepting a per-skill
`apiKey`. Apply the same change to the duplicate wording around the later block
referenced (the content currently at lines showing the duplicate wording,
originally Lines 327–330) so both places explicitly distinguish guaranteed
in-skill auth via `claude login` vs. unreliable propagation of an environment
ANTHROPIC_API_KEY.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b1abbce1-36ec-45bc-a2c5-f4f10f6df35d
📒 Files selected for processing (6)
claws/openclaw/PUBLISHING.mdclaws/openclaw/README.mdclaws/openclaw/sageox-distill/README.mdclaws/openclaw/sageox-distill/SKILL.mdclaws/openclaw/sageox-summary/README.mdclaws/openclaw/sageox-summary/SKILL.md
✅ Files skipped from review due to trivial changes (2)
- claws/openclaw/PUBLISHING.md
- claws/openclaw/sageox-summary/README.md
🚧 Files skipped from review as they are similar to previous changes (3)
- claws/openclaw/README.md
- claws/openclaw/sageox-distill/README.md
- claws/openclaw/sageox-distill/SKILL.md
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sageox-distillandsageox-summarySKILL.md frontmatter to the JSON-stylemetadatashape used by openclaw'scoding-agentskill, sorequires/installparse the way ClawHub's scanner expects.primaryEnv: ANTHROPIC_API_KEYandrequires.env: [ANTHROPIC_API_KEY]from both skills. The OpenClaw per-skillapiKeyinjection mechanism didn't actually deliver the key into the skill's process environment, so users hit auth failures with a misleading "key is set" check.claudetorequires.binsfor both skills (sageox-summary already had it; sageox-distill now declares it becauseox distillshells out toclaude).node-claudeinstall entry (@anthropic-ai/claude-code) tosageox-distill, and addid/labelfields to every install entry in both skills to match the coding-agent shape.Motivation
The skills' frontmatter was using a YAML shape that didn't match openclaw's current schema, and the
primaryEnvinjection path the prose described doesn't work in practice. Both skills would do atest -n "$ANTHROPIC_API_KEY"check, conclude the key was set, then fail on the actual Anthropic call. Aligning withcoding-agent's shape (which parses correctly) and dropping the broken injection language puts auth on the only path that actually works:claude login(Pro/Max OAuth) or shell-exportedANTHROPIC_API_KEY.What changed in the prose
SKILL.mdfiles: dropped the "§1 Environment variables" section, merged credential guidance into "§1 Required binaries", renumbered §3→§2, §4→§3, §5→§4, and rewrote the auth check to verifyclaude loginor shellANTHROPIC_API_KEY(the skill no longer claims to inject the key itself).claws/openclaw/README.md: replaced the long "Environment setup → Anthropic API key" section (per-skillapiKeyconfig, precedence rule, sandboxed Docker block) with a short "Claude credentials" section.README.mdfiles: removed broken#environment-setupanchors and per-skillapiKeylanguage.PUBLISHING.md: droppedrequires.envfrom the metadata-mismatch troubleshooting row.references/INSTALL.mdandscripts/install-ox-git.shin both skills: updated stale§ 3cross-references after the renumber.Versions
sageox-distill: 0.1.0 → 0.2.0 (new required bin, dropped per-skillapiKeycontract)sageox-summary: 0.2.0 → 0.3.0 (dropped per-skillapiKeycontract)Test plan
python3 .claude/skills/clawhub-skill-lint/scripts/lint.py claws/openclaw/sageox-distill claws/openclaw/sageox-summary→ both PASS, 0 critical / 0 warningsPUBLISHING.md)sageox-distillend-to-end against a real team withANTHROPIC_API_KEYexported in the shell — confirmox distillsucceedssageox-summaryend-to-end withclaude loginonly (noANTHROPIC_API_KEY) — confirmclaude -pinherits the OAuth session🤖 Generated with Claude Code
Summary by CodeRabbit
claudeCLI viaclaude loginor by exportingANTHROPIC_API_KEYin their shell, instead of configuring per-skill API keys.