Skill Manager All In One
v4.4.5一站式管理 OpenClaw 技能的创建、修改、发布、更新、升版与审计（技能管理、升版）。 Manage OpenClaw skills: create, modify, publish, update, upgrade, audit.
⭐ 0· 1.1k·10 current·10 all-time
byMorois@moroiser
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the content: SKILL.md is a full workflow for creating, reviewing, publishing, and auditing OpenClaw skills. Referenced tools and actions (clawhub, git, gh, local workspace, model cache) are expected for a skill-management tool and nothing unrelated is requested in metadata (no odd env vars, no unrelated binaries).
Instruction Scope
Instructions are specific and scoped to skill-authoring tasks: creating directories under ~/.openclaw/workspace, editing SKILL.md, running clawhub/git/gh commands, doing two-step verification before publishing, and manually inspecting scripts for injection risks. Note: the workflow requires the agent to read local skill files and scripts during the internal (non-output) verification step — this is appropriate for auditing/publishing but means the agent will access your workspace files. The skill explicitly requires explicit user confirmation before destructive or publish actions, which reduces risk.
Install Mechanism
No install spec and no code files to execute—this is instruction-only, the lowest-risk install mechanism. Nothing is downloaded or written by an installer.
Credentials
The skill declares no required env vars or credentials, which is consistent with being an instruction-only guide. However, many of the runtime commands it instructs (clawhub publish, git push, gh release create, clawhub login) will need the user's existing CLI auth and potentially remote tokens; those are not added or requested by the skill itself. This is proportionate but you should be aware the agent will rely on credentials already present in your environment when performing publish actions.
Persistence & Privilege
always:false and default model invocation allowed. The skill does not request permanent/always-on privilege nor attempts to modify other skills' configs. It requires user confirmation before publishing or destructive operations, limiting autonomous destructive action.
Assessment
This instruction-only skill appears coherent and is designed to audit and publish skills; before using it, be aware: (1) it will inspect files under your OpenClaw workspace (~/.openclaw/workspace/skills/ and related paths) during its internal verification step — ensure you are comfortable with that file access; (2) publishing steps (clawhub publish, git push, gh release create) will use whatever CLI credentials are present on the machine—verify your GitHub/ClawHub/gh authentication and tokens first; (3) the skill correctly enforces a two-step confirmation before executing publish/delete commands, so never approve actions you haven't reviewed; (4) when the tool asks you to inspect scripts for injection risks, treat that as a genuine manual security check — review any included scripts for os.system/subprocess shell=True/exec/eval and secrets; (5) keep backups of important skill directories and ensure large model files are placed in the recommended cache locations. If you want a stricter posture, require the agent to only produce the publish commands for you to run manually rather than letting it execute them after confirmation.Like a lobster shell, security has layers — review code before you run it.
latestvk9787wp89k1tb7n975gjwgty1d84pbyt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.