cjpkg
v1.0.0Helps users discover, when they ask questions like "how do I do X", "find a packages for Cangjie", "is there a X package for Cangjie...", or express interest...
⭐ 0· 48·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the bundled script and SKILL.md: the skill searches the Cangjie package registry and can download packages. Network endpoints used (pkg.cangjie-lang.cn) align with the described registry.
Instruction Scope
SKILL.md instructs the agent to search, download packages, ask for a project path, and help configure the Cangjie SDK. Those actions are within the skill's purpose, but the instructions also include reading and writing project files (TOML get/set via the bundled script) and may change shell startup files when configuring the SDK; these are functional but potentially intrusive and should be performed only with explicit user consent.
Install Mechanism
No install spec; this is an instruction-only skill with a small included Python script. The script performs HTTP requests to the registry domain and writes downloads to ~/Downloads. There are no opaque downloads from untrusted hosts in the install step.
Credentials
The skill declares no required env vars or credentials. The SKILL.md checks CANGJIE_HOME / CJ_SDK_PATH which are relevant to installing/configuring the Cangjie SDK and are proportionate to the task; no unrelated secrets are requested.
Persistence & Privilege
The instructions suggest adding a sourcing line to the user's shell rc (e.g., appending to .zshrc or modifying PATH on Windows) to enable the SDK. While typical for SDK setup, this modifies persistent user configuration and should only occur after explicit user approval.
Assessment
This skill appears to do what it claims: search the Cangjie registry and download packages. Before using it, confirm you trust the pkg.cangjie-lang.cn registry and be explicit about consenting to any changes: it can save files to ~/Downloads, read and write TOML project files, and — if you agree — append lines to your shell startup file to source the SDK. If you want tighter control, ask the agent to show the exact commands it will run and the exact files it will modify before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk97f0pj3x5cxspvvdzxbeak9w184p5z1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.