Skill Manager All In One | 一站式技能管理器
PassAudited by ClawScan on May 9, 2026.
Overview
This instruction-only skill is coherent for managing and publishing skills, but users should notice that it can guide high-impact publishing, deletion, GitHub, account-session, and memory-file actions with confirmation safeguards.
Install only if you want an agent to help manage and publish OpenClaw skills. Treat it like an administrative assistant: review every exact command, account, repository, slug, version, memory-file edit, and public post before giving the required 「确认-<username>」 approval.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used carelessly, the agent could publish a skill, push to GitHub, create a release, or post promotional content under the user's accounts after confirmation.
The skill explicitly covers tools and actions that can publish, push, release, or post publicly. This is aligned with the skill-manager purpose and is guarded by two-step confirmation, but the impact is significant if a user approves the wrong command.
两步验证适用于所有发布类操作：clawhub publish / git push / gh release create / 推广发帖 / 社交平台发帖等。
Before giving the required 「确认-<username>」 signature, review the exact command, target slug/repository/platform, version, and changelog or post text.
Approved operations can act as the logged-in ClawHub or GitHub user.
The skill relies on the user's existing ClawHub and GitHub authorization. That is expected for publishing workflows, but it means actions may be performed with the user's account privileges.
ClawHub 发布需要已登录会话；GitHub 发布需要 Git/GitHub 授权。
Use least-privilege accounts or tokens where possible, confirm the active account with whoami/status commands, and avoid approving actions when logged into the wrong account.
A user may not notice from registry metadata alone that the skill expects local publishing/GitHub CLIs and authenticated sessions.
The skill discloses runtime tool expectations in prose, while the registry requirements shown for this review list no required binaries and no primary credential. This is an under-declaration/provenance clarity issue, not hidden code execution.
所需工具：clawhub / git / gh
Update registry metadata to declare the expected CLIs and account-session requirements, and install/use only trusted versions of clawhub, git, and gh.
Approved edits to memory files could change future agent context or references to skills.
The skill may search and update persistent agent memory files during rename or maintenance workflows. This is purpose-aligned and paired with two-step verification, but persistent memory can affect future agent behavior.
Memory 文件 | MEMORY.md、memory/*.md、TOOLS.md 等中的名称 ... 改 Memory：MEMORY.md + memory/*.md
Review proposed memory-file changes before approval, keep backups for important memory files, and limit replacements to the specific old/new skill names.
A wrong approved rename or version update could create inconsistent local, memory, GitHub, and ClawHub state.
A rename or update workflow can propagate across local files, Git remotes, memory, GitHub, and ClawHub. The artifact includes staged reporting and confirmation safeguards, but a mistaken slug/name could have broad effects.
修改已发布技能时...必须核查以下渠道：本地文件系统、Git remote、Memory 文件、GitHub repo、ClawHub ... 改名 = 全量替换
Require the skill's proposed channel-by-channel change list before approval, verify backups or reversibility, and avoid bulk approval.