clawsec

mirror of https://github.com/prompt-security/clawsec.git synced 2026-06-14 05:51:21 +03:00

Files

T

History

David Abutbul f76824bdb6 ci(skills): pin clawhub CLI by hash via committed lockfile

Scorecard flags the skill-release workflow's npm install of the clawhub
CLI (code-scanning alerts #25/#26): version pinning alone carries no
integrity guarantee. Install it with npm ci from a committed
package-lock.json instead, so every package (clawhub + 35 transitive
deps) is verified against its sha512 hash at install time.

The publish-payload patch step now resolves the module from the local
node_modules instead of npm root -g.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-11 14:39:56 +03:00

archive-traffic.yml

fix(traffic): require a traffic-capable PAT for the archive workflow (#265 )

2026-06-11 08:25:56 +03:00

ci.yml

ci(skills): publish release trust packets + expand skill installer awareness (vercel) (#262 )

2026-06-10 13:22:22 +03:00

codeql.yml

chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 (#245 )

2026-05-27 14:39:47 +03:00

community-advisory.yml

chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (#181 )