What causes "WARN %s" in sickn33/agentic-awesome-skills?

Re-run the audit and read the specific WARN line(s) printed — each names the exact finding and file condition.

sickn33/agentic-awesome-skills · warning

WARN %s

Error message

WARN %s

What it means

This is the warn() helper in scripts/repo-audit.sh. It prints 'WARN <finding>' and sets status=1, so any audit finding (hardcoded-secret pattern, node_modules present, ripgrep missing, symlinked path component, etc.) marks the audit as failed without aborting the script; the final exit code reflects status. It is a non-fatal audit finding, not a crash.

Source

Thrown at skills/openclaw-github-repo-commander/scripts/repo-audit.sh:20

set -euo pipefail

target="${1:-.}"

if [[ ! -d "$target" ]]; then
  printf 'FAIL target directory does not exist: %s\n' "$target" >&2
  exit 2
fi

cd "$target"
repo_root="$(pwd -P)"

status=0

pass() {
  printf 'PASS %s\n' "$1"
}

warn() {
  printf 'WARN %s\n' "$1"
  status=1
}

has_symlink_component() {
  local candidate="$1"
  local current="."
  local part
  local -a parts

  candidate="${candidate#./}"
  IFS='/' read -r -a parts <<< "$candidate"
  for part in "${parts[@]}"; do
    [[ -z "$part" || "$part" == "." ]] && continue
    current="$current/$part"
    if [[ -L "$current" ]]; then
      return 0
    fi

View on GitHub (pinned to 58d857988f)

Solutions

Re-run the audit and read the specific WARN line(s) printed — each names the exact finding and file condition.
If the finding is 'possible hardcoded secret pattern found', locate the match (rg 'ghp_|sk-|AKIA'), remove the credential, and rotate it if it was ever real.
If it is 'node_modules directory present', add node_modules/ to .gitignore and run git rm -r --cached node_modules.
If it is 'ripgrep not installed', install rg (apt/brew/pacman) so the secret scan actually runs.
Treat exit 1 as actionable: fix every WARN until all lines are PASS.

Example fix

# before: realistic key committed in scripts/deploy.sh
export OPENAI_API_KEY=sk-abcdefghij1234567890abcdefghij

# after: read from environment; rotate the leaked key
export OPENAI_API_KEY="$OPENAI_API_KEY"

Defensive patterns

Strategy: validation

Validate before calling

# Pre-check the highest-signal findings before running the full audit
rg --hidden --glob '!.git/**' 'ghp_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}' . && { echo 'secret pattern present'; exit 1; }
git ls-files | grep -qE 'node_modules/' && { echo 'node_modules committed'; exit 1; }
command -v rg >/dev/null || { echo 'install ripgrep'; exit 1; }

Type guard

# Bash predicate mirroring the audit's secret check
has_secret_pattern() {
  rg --quiet 'ghp_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}' "$1"
}

Prevention

Run ./scripts/repo-audit.sh as a pre-commit hook or CI job so findings surface before merge.
Keep real credentials in env vars or a secret manager and use obviously fake placeholders in fixtures so the secret scan never matches.
Install ripgrep in the dev/CI image so the secret scan runs instead of warning 'skipped'.
Treat exit 1 as actionable: read each WARN line and fix the named finding before re-running.

When it happens

Trigger: Running ./scripts/repo-audit.sh <target> where the target contains a string matching ghp_..., sk-..., or AKIA... in the secret scan, has a node_modules directory, lacks ripgrep so the scan is skipped, or triggers any other check that calls warn. Each warn prints 'WARN <message>' and forces exit status 1.

Common situations: CI audit gates failing with exit 1; a committed .env, fixture, or docs snippet containing a realistic-looking key; a locally generated node_modules that was never gitignored; a CI image without ripgrep installed so the secret scan warns 'skipped'.

AI-assisted analysis of sickn33/agentic-awesome-skills@58d857988f (2026-08-26). Data as JSON: /api/errors/6e122db04e6f9c56. Report an issue: GitHub.