ClawHub

Skillforge

v1.0.0

Generate valid, ClawHub-ready SKILL.md files from product metadata. Give it a name, description, and instructions — get back a properly formatted SKILL.md wi...

⭐ 0· 35·0 current·0 all-time
by@mirni
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the code and runtime instructions. The package is a small FastAPI service that accepts metadata and returns SKILL.md; requiring Python and common Python packages (fastapi, uvicorn, pydantic, pyyaml) is consistent with this purpose.
✓
Instruction Scope
The provided SKILL.md instructs running a local uvicorn server and posting JSON to /v1/forge-skill. The code only processes the provided fields into YAML frontmatter + markdown; it does not read unrelated files, environment variables, or remote endpoints.
ℹ
Install Mechanism
Installation uses pip packages (fastapi, uvicorn, pydantic, pyyaml) which is expected. The install spec's 'kind' value 'uv' is unusual but does not indicate a download-from-arbitrary-URL pattern; overall install risk is moderate (standard public PyPI packages).
✓
Credentials
No environment variables or credentials are requested by the skill. The generator accepts an env_vars list to include in generated SKILL.md (this is output metadata, not requested secrets).
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges or modify other skills. Autonomous invocation is allowed by default but is not combined with other concerning factors.
Assessment
This skill appears to be a simple local service for producing SKILL.md files and is coherent with its dependencies. Before installing: (1) be aware it will install common PyPI packages (fastapi, uvicorn, pydantic, pyyaml); verify you trust those packages and your environment's pip configuration. (2) The server runs locally via uvicorn — do not bind it to public interfaces or expose it to untrusted networks. (3) The generator will include any user-supplied text verbatim in the generated SKILL.md (including any env var names or command names you pass) — do not feed it secrets or untrusted input if you plan to auto-publish outputs without manual review.

Like a lobster shell, security has layers — review code before you run it.

latestvk974ww8bv189gbrct5cswm5k3184rb6r

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🔨 Clawdis
Binspython

Install

uv

Comments