Clawic CLI
v1.0.0Search, inspect, and install Clawic skills from GitHub with local lexical matching, registry overrides, and safe destination control.
⭐ 0· 107·0 current·0 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (discover, inspect, install Clawic skills) match the declared requirements: Node and either a clawic binary or npx, plus a local config folder (~/clawic/) for non-secret metadata. No unrelated credentials, binaries, or paths are requested.
Instruction Scope
SKILL.md confines actions to expected tasks: checking runtime (Node version, npx vs global binary), downloading registry index/manifest, showing manifests, and writing files into an explicit destination (<root>/<slug>/). It documents using ~/clawic/ for memory and explicitly warns not to store secrets. No instructions ask the agent to read unrelated system files or exfiltrate data.
Install Mechanism
This is instruction-only (no install spec), minimizing write-at-install risk. Metadata and docs recommend installing the published npm package or using npx. Note: npx causes ad-hoc package fetches from npm (documented in the skill); for reproducibility/trust the docs correctly recommend global or pinned installs.
Credentials
No required environment variables or credentials are declared. The only optional env var mentioned is CLAWIC_REGISTRY_BASE_URL for explicit registry overrides, which is reasonable and documented. The only required config path is ~/clawic/ for non-secret memory files.
Persistence & Privilege
Skill is not always-enabled and allows autonomous invocation (default), which is normal. It stores only its own memory under ~/clawic/ and does not request system-wide configuration changes or other skills' secrets.
Assessment
This skill appears coherent and limited to its documented purpose. Before using it: (1) confirm you have Node.js 20+ and decide whether to use npx (ad-hoc fetches) or install the clawic package globally or pinned in a project for reproducibility; (2) always run `clawic show <slug>` to inspect a manifest before `install`; (3) explicitly set and verify the install destination (use --dir) to avoid accidental overwrites; (4) avoid setting a custom CLAWIC_REGISTRY_BASE_URL unless you trust the mirror, since the CLI will fetch index/manifests from whatever base you specify; and (5) note that ~/clawic/ is used for non-secret workflow memory — do not store tokens there.Like a lobster shell, security has layers — review code before you run it.
latestvk977cfjpx6gv2w84ynb9m6m9x983h70w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
CLI Clawdis
OSLinux · macOS · Windows
Binsnode
Any binclawic, npx
Config~/clawic/