All-skill-list

This skill appears to do exactly what it claims (aggregate and export local skills), but exercise caution before running it: - The script loads and writes a cache using Python's pickle. Untrusted pickle files can execute arbitrary code when loaded. If an attacker or other user can modify ~/.openclaw/workspace/skills/all-skill-list/scripts/skills_cache.pickle, running the script could run that code. - Before installing/running: inspect the script (scripts/skill-list.py) yourself and ensure the skills directory and the all-skill-list/scripts directory are writable only by you/trusted users. - If you want to reduce risk: delete any existing skills_cache.pickle before the first run, or modify the script to use JSON for cache storage instead of pickle (safer), or run the script in a restricted sandbox/container. - Be aware the tool will read the full contents of SKILL.md files across your skills tree (and can export them). Don’t place secrets or sensitive tokens in those files. I rate this suspicious (not outright malicious) because the core functionality is coherent but the use of pickle for caching and reading/writing files under the skills tree are legitimate design choices that carry tangible security risks if files are tampered with. If you can verify the script and control file permissions, the risk is much lower.