Conversation
📝 WalkthroughWalkthroughUpdated repository documentation to expand and reorganize security vulnerability reporting guidance: README.md adjusts the documentation table and Security section; SECURITY.md adds detailed reporting channels, submission steps, checklist, and expected handling; docs/index.md adds a "Report Vulnerabilities" link to SECURITY.md. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
README.md (1)
1-2:⚠️ Potential issue | 🟠 MajorAdd the required SPDX header at the top of
README.md.The Markdown SPDX copyright/license header is missing.
Proposed fix
+<!-- + SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. + SPDX-License-Identifier: Apache-2.0 +--> + # 🦞 NVIDIA NemoClaw: Reference Stack for Running OpenClaw in OpenShellAs per coding guidelines,
**/*.{js,cjs,mjs,ts,tsx,sh,md}files must include SPDX headers and Markdown files must use HTML comments.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` around lines 1 - 2, Add the required SPDX Markdown header to the top of README.md (above the existing title line "# 🦞 NVIDIA NemoClaw: Reference Stack for Running OpenClaw in OpenShell"): insert the two HTML comment SPDX lines (copyright text and SPDX-License-Identifier) as per project policy so the file contains the SPDX header in HTML comment form for Markdown files; ensure the header appears before any other content and follows the same format used across other docs in the repo.
🧹 Nitpick comments (1)
SECURITY.md (1)
8-8: Use active voice in these sentences.Both lines use passive constructions; rewrite to active voice for docs consistency.
As per coding guidelines, "Active voice required. Flag passive constructions."
Also applies to: 53-53
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@SECURITY.md` at line 8, Rewrite the passive sentences to active voice: replace "If a potential security issue is inadvertently reported through a public channel, NVIDIA maintainers may limit public discussion and redirect the reporter to the appropriate private disclosure channels." with an active-voice version that names the actor and direct object (for example: "If you inadvertently report a potential security issue through a public channel, NVIDIA maintainers may limit public discussion and will redirect you to the appropriate private disclosure channels."); apply the same change to the related sentence at the other occurrence (the line referenced as also applies to: 53-53) so both instances use active voice and address the reporter directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@SECURITY.md`:
- Around line 1-3: Add an SPDX header HTML comment at the very top of the
Markdown file before the "## Security" heading: insert the required SPDX
copyright and license block (in HTML comment form) as specified by the coding
guidelines so the file includes the SPDX header for Markdown files; ensure the
comment appears above the existing "## Security" line.
---
Outside diff comments:
In `@README.md`:
- Around line 1-2: Add the required SPDX Markdown header to the top of README.md
(above the existing title line "# 🦞 NVIDIA NemoClaw: Reference Stack for
Running OpenClaw in OpenShell"): insert the two HTML comment SPDX lines
(copyright text and SPDX-License-Identifier) as per project policy so the file
contains the SPDX header in HTML comment form for Markdown files; ensure the
header appears before any other content and follows the same format used across
other docs in the repo.
---
Nitpick comments:
In `@SECURITY.md`:
- Line 8: Rewrite the passive sentences to active voice: replace "If a potential
security issue is inadvertently reported through a public channel, NVIDIA
maintainers may limit public discussion and redirect the reporter to the
appropriate private disclosure channels." with an active-voice version that
names the actor and direct object (for example: "If you inadvertently report a
potential security issue through a public channel, NVIDIA maintainers may limit
public discussion and will redirect you to the appropriate private disclosure
channels."); apply the same change to the related sentence at the other
occurrence (the line referenced as also applies to: 53-53) so both instances use
active voice and address the reporter directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 136fcc91-41d4-4dd4-bd11-a080303539ee
📒 Files selected for processing (3)
README.mdSECURITY.mddocs/index.md
| <!-- markdownlint-disable MD041 --> | ||
| ## Security | ||
|
|
There was a problem hiding this comment.
Add the required SPDX header block at the top of this Markdown file.
This file is missing the required SPDX copyright and license header in HTML comment form.
Proposed fix
+<!--
+ SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ SPDX-License-Identifier: Apache-2.0
+-->
+
<!-- markdownlint-disable MD041 -->
## SecurityAs per coding guidelines, **/*.{js,cjs,mjs,ts,tsx,sh,md} files must include SPDX headers and Markdown files must use HTML comments.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <!-- markdownlint-disable MD041 --> | |
| ## Security | |
| <!-- | |
| SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| SPDX-License-Identifier: Apache-2.0 | |
| --> | |
| <!-- markdownlint-disable MD041 --> | |
| ## Security | |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@SECURITY.md` around lines 1 - 3, Add an SPDX header HTML comment at the very
top of the Markdown file before the "## Security" heading: insert the required
SPDX copyright and license block (in HTML comment form) as specified by the
coding guidelines so the file includes the SPDX header for Markdown files;
ensure the comment appears above the existing "## Security" line.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
README.md (1)
1-1:⚠️ Potential issue | 🟠 MajorAdd required SPDX header at the top of this Markdown file.
README.mdis missing the required SPDX license header comments.Proposed fix
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. --> +<!-- SPDX-License-Identifier: Apache-2.0 --> + # 🦞 NVIDIA NemoClaw: Reference Stack for Running OpenClaw in OpenShellAs per coding guidelines, “
**/*.{js,cjs,mjs,ts,tsx,sh,md}: Include SPDX license header at the top of every source file … Use#comments for shell scripts and HTML comments for Markdown files.”🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` at line 1, Add the required SPDX license header as an HTML comment at the very top of README.md (above the "# 🦞 NVIDIA NemoClaw..." title). Insert a one-line or multi-line HTML comment containing the SPDX copyright/text and SPDX-License-Identifier (e.g., SPDX-FileCopyrightText and SPDX-License-Identifier fields) so the Markdown file complies with the project's SPDX header rule.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@README.md`:
- Line 1: Add the required SPDX license header as an HTML comment at the very
top of README.md (above the "# 🦞 NVIDIA NemoClaw..." title). Insert a one-line
or multi-line HTML comment containing the SPDX copyright/text and
SPDX-License-Identifier (e.g., SPDX-FileCopyrightText and
SPDX-License-Identifier fields) so the Markdown file complies with the project's
SPDX header rule.
3 participants
Summary
Previews:
Signed-off-by: Miyoung Choi miyoungc@nvidia.com
Type of Change
Testing
npx prek run --all-filespasses (or equivalentlymake check).npm testpasses.make docsbuilds without warnings. (for doc-only changes)Checklist
General
Code Changes
npx prek run --all-filesauto-fixes formatting (ormake formatfor targeted runs).Doc Changes
update-docsagent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docscatch up the docs for the new changes I made in this PR."Summary by CodeRabbit