matevip b64a312994 fix(skill): harden GitHub token handling against credential leaks ... The previous private-repo support inlined the access token into the clone URL and then logged that URL on success — leaking the token to log files, container stdout, and any IOException thrown when the clone failed. The token also appeared in the process command line, visible to anyone with shell access via `ps`. Switch to git's GIT_CONFIG_COUNT/KEY/VALUE environment variables, which inject `http.extraHeader: Authorization: Bearer <token>` into the child process without ever touching argv or the repo URL. The URL stays pristine, so the existing INFO log and error message are safe. Other changes: - Resolve token from `mateclaw.skill.github-token` property first, then fall back to GITHUB_TOKEN env var. Keeps the original deployment contract while letting admins manage the credential via configuration. - Tighten the host check (prefix match on `https://github.com/` etc.) so a crafted URL like `https://evil.com/?u=github.com/...` cannot trick the fetcher into forwarding the token to a third party. - Set GIT_TERMINAL_PROMPT=0 so a bad token fails fast instead of blocking on an interactive password prompt.		2026-05-26 23:11:46 +08:00
..
java/vip/mate	fix(skill): harden GitHub token handling against credential leaks	2026-05-26 23:11:46 +08:00
resources	feat(agent): explicit "no skills / no tools" opt-out flags (#184)	2026-05-26 22:07:12 +08:00