Skill Discoverer
v1.0.0Skill Discoverer — Skill 广场发现者。自动发现 Skill 广场新上线 skill，或按工作背景智能推荐。将候选 skill 分类为工具型（直接安装）和增强型（会影响 agent 行为），对增强型提供三种处理方式：整体安装 / 内化学习（规则写入 MEMORY.md）/ 只应用无冲突部分。...
⭐ 0· 73·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to discover and recommend marketplace skills and to classify them as tool/augmenting; its runtime instructions only request access to local agent files (USER.md, memory/*.md), the current session metadata (channel/chat_id), and operate via the 'skillhub' skill (with a documented curl fallback). All of these are coherent with discovery/recommendation functionality. No unrelated credentials, binaries, or system-level changes are requested.
Instruction Scope
Instructions read USER.md and recent memory files for personalization, read target skills' SKILL.md, and write a config and known_skills cache in ~/.openclaw/workspace/skill-discoverer/. They also propose writing rules into agent files (MEMORY.md, SOUL.md, HEARTBEAT.md/TOOLS.md) — but only after explicit per-item user confirmation. These behaviors are within the stated scope but high-impact (they modify core agent memory/behavior when the user consents), so users should review any proposed writes before confirming.
Install Mechanism
No install spec or code files are executed; this is instruction-only and does not download or extract external archives. The documented fallback curl to clawhub uses a public API URL (no shorteners or personal IPs). Overall install risk is low.
Credentials
The skill declares no required environment variables, credentials, or special config paths. It accesses session metadata and local agent files which are relevant to personalization and to sending reports to the correct channel. There are no unexplained SECRET/TOKEN/PASSWORD requests.
Persistence & Privilege
The skill will create and persist config/cache files under ~/.openclaw/workspace/skill-discoverer/ and can create cron jobs if the user chooses a periodic schedule. It does not set always:true and requires user confirmation before installing/transforming other skills. Creating cron tasks and appending to MEMORY.md/SOUL.md are powerful actions but are described as explicit opt-in; users should be mindful when consenting.
Assessment
This skill is coherent with its stated purpose, but it can modify agent behavior and schedule recurring scans when you agree. Before installing, consider: 1) Review the exact text of any rules it proposes to write into MEMORY.md / SOUL.md / HEARTBEAT.md and only approve items you understand; 2) Be deliberate about enabling scheduled cron scans and confirm the destination channel/chat_id it will save; 3) When a recommended skill is labeled '增强型' (augmenting), carefully inspect the four-column analysis and the listed ⚠️/🚨 items before allowing '学习并转化' or direct installation; 4) Keep backups of MEMORY.md / SOUL.md if you want an easy rollback. If you want extra caution, run it in a test agent instance first or decline automatic cron creation and use manual scans only.Like a lobster shell, security has layers — review code before you run it.
latestvk9754vdj0xkja8rnkgj3shadb183r5jq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.