@blockchain-forever/aelf-skills

Discovery, download, and configuration hub for the entire aelf agent skill ecosystem. Use when the user wants to: (1) explore or list available aelf skills,...

Security Scan

The skill is internally consistent with its stated role as a hub that lists, downloads, and bootstraps aelf ecosystem skills — it requires no unexplained credentials and uses npm/git/tar/bun flows that fit its purpose.

Purpose & Capability

Name/description match the code and SKILL.md: this package is a catalog/bootstrapping hub. The scripts build a skills catalog, clone/npm-pack skill packages, and run setup/health commands. Required tools (git, npm, bun, tar) are appropriate for those tasks and no unrelated credentials or config paths are requested.

Instruction Scope

SKILL.md instructs the agent to run bootstrap.sh, bun run setup, and health checks. Those steps read skills-catalog.json/workspace.json and then download and operate on third-party skill repos. This stays within the hub's purpose, but the runtime behavior grants the agent the ability to fetch and operate on external code (including running each skill's setup/install scripts).

Install Mechanism

Bootstrap code downloads via npm (npm pack -> tar extract) and via git clone (GitHub). It extracts tarballs to disk and runs 'bun install' inside downloaded skill directories. These are standard mechanisms for a bootstrapper but are a supply-chain risk: tar extraction and executing package install/setup scripts means arbitrary code from npm/github will be written and executed locally.

Credentials

The package declares no required environment variables or credentials. Some utilities (expandPathWithEnv) will expand ${VARS} found in workspace paths and will error if missing; runCommand inherits process.env when spawning installs, so local environment variables could be visible to child processes. No unrelated secret variables are explicitly requested by the skill.

Persistence & Privilege

The skill is not forced-always, is user-invocable, and does not claim to modify other skills' config. It writes downloaded skill files to a destination directory (downloaded-skills), which is expected behavior for a bootstrap tool.

Assessment

This package is coherent for its stated purpose, but it is a bootstrapper that downloads and installs third-party skill packages and will run their install/setup scripts. Before installing or running it: 1) review skills-catalog.json and the repository URLs for the skills you'll bootstrap; prefer known GitHub repos; 2) run bootstrap in a contained environment (container, VM, or a machine without sensitive credentials) or use --skip-install and inspect code first; 3) consider using --source=github or --source=local to avoid unexpected npm package variants; 4) be aware that 'bun install' and package setup scripts inherit your environment — avoid running on hosts with high-value secrets; 5) if you need higher assurance, inspect individual skill packages (or run security:audit) before allowing automated bootstrap/installation.

aelf Skills Hub

One-stop meta-skill for discovering, downloading, configuring, and routing all aelf ecosystem skills.

Available Skills

Read skills-catalog.json for the full machine-readable registry. Current skills:

ID	Domain
portkey-ca-agent-skills	CA wallet: registration, auth, guardian, transfer
portkey-eoa-agent-skills	EOA wallet: create, import, assets, transfer
aelf-node-skill	Node: chain status, block, tx, contract view/send
aelfscan-skill	Explorer: address, token, NFT, statistics analytics
awaken-agent-skills	DEX: quote, swap, liquidity, K-line
eforest-agent-skills	NFT marketplace: symbol, collection, listing, trade
tomorrowdao-agent-skills	Governance: DAO, proposals, BP election, resources

Workflow

1. Route user intent

Read docs/SKILL_ROUTING_MATRIX.md to map intent → skill.

Key rules:

• Wallet: default EOA; switch to CA on guardian/register/recover/CA-hash signals.
• Chain data: aelf-node-skill for raw node interaction; aelfscan-skill for aggregated analytics.
• DEX/NFT: domain skill handles logic; wallet skill provides signing identity.
• Ambiguous: return Recommended / Alternative / Reason.

2. Bootstrap the skill

./bootstrap.sh --only <skill-id>

Options: --source auto|npm|github|local, --skip-install, --skip-health, --dest <dir>.

3. Configure for client

After bootstrap, run setup inside the downloaded skill directory:

cd downloaded-skills/<skill-id>
bun run setup openclaw   # for OpenClaw
bun run setup cursor     # for Cursor
bun run setup claude     # for Claude Desktop

4. Health check

bun run health:check -- --skills-root ./downloaded-skills

Recovery

Problem	Action
Dependency download failed	./bootstrap.sh --source github --only <skill-id>
skill-id not found	bun run catalog:generate, then retry
Health check failed	Follow health:check output, add missing artifacts

References

• Catalog field semantics: docs/CATALOG_SCHEMA.md
• Intent routing matrix: docs/SKILL_ROUTING_MATRIX.md
• E2E scenarios with recovery: docs/AI_E2E_SCENARIOS.md
• Security audit: bun run security:audit