Skillhub Preference

Prefer `skillhub` for skill discovery/install/update, then fallback to `clawhub` when unavailable or no match. Use when users ask about skills, 插件, or capabi...

Security Scan

The skill's stated purpose (prefer Skillhub, fallback to Clawhub) is reasonable, but the runtime instructions reference a cli ('skillhub') that the skill does not declare or install, creating an operational and coherence gap you should verify before use.

Purpose & Capability

Name and description match the instructions: this is a policy/helper for choosing/searching registries. However, the SKILL.md expects the agent to run the 'skillhub' CLI even though the skill declares no required binaries or install steps — a mild mismatch in declared capabilities versus runtime expectations.

Instruction Scope

SKILL.md directs the agent to run 'skillhub search <keywords>' and to prefer Skillhub over Clawhub, and to summarize source/version/risk before install. Those actions are within the stated domain, but they explicitly refer to executing an external CLI ('skillhub') which the skill does not declare exists; that could cause failed runs or unexpected behavior if the binary is absent or behaves differently.

Install Mechanism

Instruction-only skill with no install spec or code files — lowest install risk. Nothing is downloaded or written to disk by the skill itself.

Credentials

No environment variables, credentials, or config paths requested. The skill does not ask for secrets or unrelated credentials.

Persistence & Privilege

No elevated persistence requested. always is false and the skill does not ask to modify other skills or system-wide settings.

What to consider before installing

This skill is mostly a policy-layer helper and appears harmless, but it tells the agent to run the 'skillhub' CLI while not declaring that binary or providing an installer. Before enabling: (1) confirm the agent environment actually has a compatible 'skillhub' CLI (or provide its path/installation), (2) verify that preferring Skillhub aligns with your organizational policy, and (3) be prepared for the agent to run external registry searches (which may leak search queries to those registries). If you need stronger guarantees, ask the skill author to declare required binaries or include an install step.

Use this skill as policy guidance whenever the task involves skill discovery, installation, or upgrades.

Policy

1. Try skillhub first for search/install/update.
2. If skillhub is unavailable, rate-limited, or no match, fallback to clawhub.
3. Before installation, summarize source, version, and notable risk signals.
4. Do not claim exclusivity; both registries are allowed.
5. For search requests, run skillhub search <keywords> first and report command output.