feat(autoreview): replace vendored copy with canonical openclaw/agent-skills

[BramVR]

Replaces the vendored autoreview skill with the canonical copy from openclaw/agent-skills at c4ab5e7f999cf504890986322473d3e7afd373af.

Why

Our copy was a 2026-06-13 snapshot taken after steipete extracted the skill out of agent-scripts (upstream's skills/autoreview has been a symlink to a repo we couldn't see since 2026-05-24). The canonical version has moved a long way since — most of it security work.

• helper: 2,485 → 12,001 lines
• SKILL.md: 327 → 444 lines
• new: a 255-test hardening suite, autoreview_test.py, TypeScript fixtures

What we gain

• TruffleHog secret scanning. Our copy had zero matches for trufflehog|secret_scan|redact; the canonical one has 71. Before any engine invocation it snapshots the exact added/modified content under review and scans it. Recent upstream commits are almost entirely this subsystem: replacing heuristics with TruffleHog (#145), scanning deleted credentials (#148), snapshot path-traversal hardening (#150), force-staging scan snapshots (#151), safe URI userinfo (#146).
• Scope Governor — "Autoreview is a closeout gate, not permission to rewrite the task." Freezes a scope baseline, then classifies each finding as in-scope blocker / follow-up / stop-and-escalate.
• Oversized Bundles and Release Branches And Release Process sections.
• Codex gpt-5.6-sol with an access-only fallback to gpt-5.6-terra.
• Skill-level AGENTS.md (plus CLAUDE.md symlink) declaring openclaw/agent-skills canonical and forbidding repo-local behavior variants — future syncs should copy the whole directory rather than patch ours.

Behavior changes to be aware of

• Engines that cannot be fully isolated are now refused, not run: droid, copilot, opencode, cursor. Our copy still ran copilot and opencode; that permissiveness predates a deliberate hardening decision upstream.
• --preset no longer exists. AGENTS.MD told agents to run $autoreview --preset claude-opus for API work; that line now reads --engine claude --model claude-opus-4-8, which is the equivalent under the new flag set.
• TruffleHog is a hard dependency — run_trufflehog_preflight raises SystemExit when the binary is missing. See the blocker below.

Verification

• python3 -m py_compile clean on both scripts/autoreview and scripts/autoreview_test.py.
• scripts/autoreview_test.py: 31 tests, all pass.
• tests/test_autoreview_hardening.py: 255 tests, 251 pass, 1 skipped, 4 fail — all four failures are Unable to locate a Java Runtime on this machine (JVM-isolation tests). Environmental, not a port defect.
• scripts/validate-skills passes.
• Executable bits and the CLAUDE.md -> AGENTS.md symlink survived the copy.

Blocker before this is usable

TruffleHog is not installed on this Mac, and AGENTS.MD requires $autoreview before every commit/land — so merging this without installing it breaks the pre-land gate for every repo.

brew install trufflehog

[Copilot]

Pull request overview

Syncs this repo’s autoreview skill to the canonical openclaw/agent-skills implementation (commit c4ab5e7…), primarily to pick up significant security hardening (TruffleHog-based secret scanning + isolation/refusal rules) and the expanded test suite/fixtures.

Changes:

• Replace/update the autoreview skill docs and implementation, including engine policy (refuse non-isolatable engines) and new TruffleHog preflight scanning.
• Add/expand test coverage (hardening suite, harness updates) plus TS fixtures used to validate secret-detection behavior.
• Update repo-level guidance (AGENTS.MD) and changelog to reflect the --preset removal and new recommended CLI flags.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
skills/autoreview/SKILL.md	Updates the skill contract/docs (scope governor, isolation rules, TruffleHog requirement, CLI flag changes).
skills/autoreview/AGENTS.md	Declares openclaw/agent-skills as canonical source and forbids downstream behavior variants.
skills/autoreview/scripts/autoreview	Canonical helper implementation (bundle building, isolation, TruffleHog preflight, engine orchestration).
skills/autoreview/scripts/autoreview_test.py	Adds unit tests for critical parsing/isolation/compat behaviors.
skills/autoreview/scripts/test-review-harness.py	Updates harness engines/defaults and validates prompt scope policy presence.
skills/autoreview/scripts/test-review-harness.ps1	Aligns PowerShell harness engine set with the new supported engines.
skills/autoreview/tests/test_autoreview_hardening.py	Adds/updates hardening regression tests for isolation and credential handling.
skills/autoreview/tests/fixtures/typescript-sensitive-literals.ts	Adds sensitive-literal corpus fixture for secret detection.
skills/autoreview/tests/fixtures/typescript-benign-references.ts	Adds benign “credential plumbing” fixture to avoid false positives.
skills/autoreview/tests/fixtures/typescript-benign-config-path-references.ts	Adds benign config-path fixture to ensure path strings are preserved.
CHANGELOG.md	Documents the canonical autoreview sync and major behavior/security changes.
AGENTS.MD	Updates API-work guidance to the new --engine/--model flags (no --preset).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.