skill-inventory

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: skill-inventory Version: 1.0.0 The skill-inventory bundle is a utility designed to scan the local skills directory and generate a summary markdown file (skills.md). The Python script (inventory.py) uses standard path manipulation and regex to extract metadata from SKILL.md files and contains no network activity, obfuscation, or unauthorized file access beyond its stated scope.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the skill executes a local script that scans installed skill folders and writes an inventory file.

Why it was flagged

The skill tells the user or agent to run a local Python script. This is expected for generating the inventory, but users should recognize that installing the skill includes executable code.

Skill content
python3 <你的skills目录>/skill-inventory/inventory.py
Recommendation

Run it only from the intended skills directory and review the included inventory.py if you want to confirm exactly what it writes.

What this means

If another installed skill contains misleading metadata, parts of that metadata could be carried into the generated skills.md and reused as context.

Why it was flagged

The generated skills.md is persistent context derived from installed skills’ SKILL.md files and is intended to be read after startup.

Skill content
读取每个技能的 SKILL.md 获取元信息
- 生成 skills.md 文件记录所有技能

1. **每次启动后**,读取 `skills.md` 知道有哪些技能可用
Recommendation

Treat skills.md as an index, not as authoritative instructions, and periodically review it if installing skills from unfamiliar sources.