ClawHub

Forgejo Workflow

v0.1.1

Forgejo via fj and REST API for repos, issues, PRs, wiki, CI, and reviews.

⭐ 0· 1·0 current·0 all-time
by@nerasse
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (Forgejo via fj and REST API) match the required binaries (fj, curl, jq, git), the declared env vars (FORGEJO_URL, FORGEJO_TOKEN), and the brew install of forgejo-cli. All requested items are expected for the stated functionality.
✓
Instruction Scope
SKILL.md instructions consistently use fj and REST calls to $FORGEJO_URL with Authorization: token $FORGEJO_TOKEN. The runtime steps check only the declared binaries, env vars, and fj auth state; they do not instruct reading unrelated files or environment variables or sending data to unexpected external endpoints.
✓
Install Mechanism
Install spec is a single brew formula (forgejo-cli) producing fj. Using Homebrew for a CLI is proportionate and low-risk compared with arbitrary downloads. No extract-from-URL or unknown host installs are present.
✓
Credentials
Only FORGEJO_URL and FORGEJO_TOKEN are required and the skill names FORGEJO_TOKEN as the primary credential. These are proportionate to the skill's ability to call the Forgejo API and operate fj. No unrelated credentials or secret environment variables are requested.
✓
Persistence & Privilege
The skill does not request always:true and does not declare system-wide config changes. Autonomous invocation is allowed by default (platform default) but is not combined with other red flags. The skill's scope is limited to interacting with the specified Forgejo instance and local git.
Assessment
This skill is internally consistent, but note that FORGEJO_TOKEN is a powerful credential: only provide a token with the minimal scopes required and target the correct FORGEJO_URL. Install fj from a trusted Homebrew tap and verify the formula source if you have strict supply-chain concerns. Before installing, decide whether to use a short-lived or limited-scope application token (rather than a full admin token), and ensure you understand that the skill can read and modify repos, PRs, issues, wiki pages, and CI on the targeted Forgejo instance when invoked.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a1fnpsqsa4zqcm34vx3k18584hdqf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🦊 Clawdis
Binsfj, curl, jq, git
EnvFORGEJO_URL, FORGEJO_TOKEN
Primary envFORGEJO_TOKEN

Install

Install Forgejo CLI (brew)
Bins: fj
brew install forgejo-cli

Comments