ClawHub

AgentVerse CLI

v0.1.4

Publish, discover, and manage AI skills, agents, workflows, souls and prompts from the AgentVerse marketplace. Use when working with the agentverse CLI to se...

⭐ 0· 53·0 current·0 all-time
byHal@loonghao
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the instructions and file metadata: the skill is an instruction-only wrapper for the agentverse CLI (search/publish/manage marketplace artifacts). Required binary 'agentverse' and the documented commands align with that purpose.
✓
Instruction Scope
SKILL.md instructs the agent to run agentverse CLI commands and to set optional env vars (AGENTVERSE_URL, AGENTVERSE_TOKEN). It does not request unrelated files, system paths, or additional secrets beyond what the CLI would reasonably need.
ℹ
Install Mechanism
The provided install instructions use curl from raw.githubusercontent.com piped to bash (and a PowerShell iex command). GitHub raw is a common release location and the skill.json also references GitHub releases, but piping remote scripts to a shell executes remote code and should be reviewed before running. This is expected for a CLI installer but is an elevated risk compared with instruction-only skills that require an already-installed binary.
✓
Credentials
No required environment variables are declared. The docs mention AGENTVERSE_URL and AGENTVERSE_TOKEN as expected CLI flags/envs. Suggest caution if asked to provide unrelated tokens (e.g., GitHub tokens) to the tool; those are optional for rate-limit avoidance in self-update.
✓
Persistence & Privilege
Skill is instruction-only, has always: false, and does not request persistent privileges or modify other skills or system-wide agent settings. Autonomous invocation is permitted by platform default but not combined with other red flags.
Assessment
This skill is essentially documentation for the agentverse CLI and is coherent with that purpose. The main thing to watch for: the install commands run a remote installer from raw.githubusercontent.com and execute it directly (curl | bash and PowerShell iex). That will run arbitrary code from that repository on your machine. Before installing, manually inspect the referenced install.sh / install.ps1 in the project repo (https://github.com/loonghao/agentverse) or prefer installing from signed GitHub release assets or your distro/package manager. Only provide tokens (GitHub, AGENTVERSE_TOKEN) if you understand why the CLI needs them and trust the upstream project. If you already have the 'agentverse' binary installed by a trusted channel, you can use this skill without running the remote installer.

Like a lobster shell, security has layers — review code before you run it.

latestvk970p9kmsfnj14bgrd4gc4f5hs83s1hv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🤖 Clawdis
Binsagentverse

Comments