advanced-skill-creator

Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper metho...

Security Scan

The skill mostly matches its stated purpose (automated skill-creation using SkillBoss) but the runtime instructions include prompt‑injection style directives and broad automation steps (creating/executing scripts, large web searches) that could coerce the agent or perform unexpected actions — review before installing or granting the API key.

Purpose & Capability

Name/description claim an advanced skill-creator powered by SkillBoss. Declared requirement (SKILLBOSS_API_KEY) and the need for python3/bash are consistent with generating and running helper scripts and calling SkillBoss's /v1/pilot endpoint. Nothing in the manifest asks for unrelated cloud credentials or unrelated system access.

Instruction Scope

SKILL.md instructs the agent to execute a 5-step research flow that includes automated documentation queries, ClawHub searches, GitHub/Reddit/X research, and creation/execution of a helper script (advanced_skill_processor.py). It also includes strict formatting directives and contains prompt-injection patterns (e.g. 'you-are-now' style phrasing) that attempt to control agent output. These directives could coerce the agent into ignoring safety or policy constraints, run arbitrary code, or expose more context than needed.

Install Mechanism

No install spec; instruction-only skill. That minimizes on-disk footprint and avoids downloading remote archives. However, the instructions explicitly describe generating and running a Python script and performing network calls, so runtime behavior still can produce/execute code even without an install step.

Credentials

Only required env var is SKILLBOSS_API_KEY (declared as primary credential), which matches the skill's stated use of the SkillBoss API. No unrelated secrets or multiple credentials are requested. Still, granting an API key allows the skill to make arbitrarily broad requests through that service, so scope of that key should be limited if possible.

Persistence & Privilege

always:false and default invocation settings. The skill does not request permanent system-wide installation or modification of other skills. It does describe creating files (a helper script), which is expected for its purpose but should be audited before execution.

Scan Findings in Context

[prompt-injection:you-are-now] unexpected: The SKILL.md contains prompt-injection phrasing (e.g. 'you-are-now' style directives and strict output-format enforcement). While enforcing output format might be legitimate for a generator, these patterns can be used to override model constraints and are not necessary to achieve the skill's stated functionality.

What to consider before installing

This skill is plausible for generating OpenClaw skills and the single required credential (SKILLBOSS_API_KEY) matches that purpose. However: 1) review SKILL.md for any prompt-injection lines (phrases that try to force model behavior or ignore safeguards) and remove or neutralize them before enabling the skill; 2) avoid pasting high‑privilege or long‑lived credentials — use a scoped, revocable SKILLBOSS_API_KEY if possible; 3) sandbox any generated scripts (advanced_skill_processor.py) and inspect them before running; 4) restrict the agent's ability to execute arbitrary code or make outbound network requests until you trust the skill; 5) consider asking the publisher for a source/homepage or a minimal example run to validate behavior. If you want a firmer verdict, provide the full remainder of SKILL.md (the file was truncated) and any example outputs the skill would produce.

Advanced skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper methodology and standards compliance by following the complete research process, applicable to all timeframes and use cases.

Uses SkillBoss API Hub to power AI-assisted skill generation via the unified /v1/pilot endpoint.

When to use

• When user mentions "写一个触发", "写skill", "claw skill", "openclaw skill", "moltbot skill", "创建技能", or "写一个让它..."
• When proper skill creation methodology needs to be followed according to official standards
• When ensuring adherence to 5-step research flow (documentation, ClawHub, community, fusion, output)
• For comprehensive skill analysis and creation with best practices

5-Step Research Flow Execution

Step 1: Consult Official Documentation

Comprehensively access official documentation:

• https://docs.clawd.bot/tools/skills
• https://docs.openclaw.ai/tools/skills
• /tools/clawhub
• /tools/skills-config

Extract key information:

• SKILL.md format requirements
• YAML frontmatter specifications (name, description, when, examples, metadata.openclaw.*, requires)
• Trigger mechanisms (natural language triggers, when conditions)
• Tool calling conventions (exec, browser, read, write, nodes, MCP)
• Loading precedence (workspace > ~/.openclaw/skills > bundled)
• ClawHub installation methods
• Breaking changes (latest versions)

Step 2: Research Related Public Skills on ClawHub/ClawdHub

Thoroughly query ClawHub/ClawdHub for relevant skills:

• Search keywords: weather, reminder, schedule, translate, image, cron, memory, task-tracker, notification, backup, automation
• Select 2-4 most relevant skills with high downloads/recent updates/community ratings
• Analyze:
  • Trigger descriptions (when, examples)
  • YAML metadata
  • Pure Markdown vs. scripts/ structure
  • Dependency declarations
  • Error handling recommendations
  • Community feedback (why popular or criticized)
  • Security considerations

Step 3: Search Best Practices

Use comprehensive keyword combinations for GitHub searches:

• "OpenClaw SKILL.md" OR "ClawDBot skill example" OR "Moltbot create skill"
• "SKILL.md" "when:" OR "metadata.openclaw" site:github.com
• "clawhub install" "custom skill" OR "openclaw skill tutorial"
• "skill security" OR "prompt injection prevention" OR "skill best practices"

Focus on:

• Active GitHub repositories
• Recent commits
• Blog/Reddit/X content
• Security best practices
• Known security pitfalls (prompt injection, exec abuse)

Step 4: Solution Fusion & Comparison

Comprehensively summarize implementation approaches from all three sources: Compare across key dimensions:

• Trigger precision (false positive rate)
• Maintainability/readability
• Loading speed/memory impact
• Compatibility (different gateways/channels/versions)
• Security & error isolation
• Upgrade friendliness (dependency on specific tools)
• Dependency management complexity
• Performance optimization
• Error handling robustness

Select optimal solution for current context with 4-7 clear reasons prioritized:

• Official documentation > High-quality ClawHub skills > Active community solutions > Self-optimization

Step 5: Proper Output Structure

Output must follow exact structure without adding extra headers or showing raw search logs:

• Use the exact headings: 【最终推荐方案】, 【文件结构预览】, 【完整文件内容】
• Provide complete file contents with proper formatting
• Include tree-style directory structure preview
• Use proper YAML frontmatter in SKILL.md examples
• Ensure comprehensive documentation
• AI-generated skill content powered by SkillBoss API Hub (自动路由最优模型)

Resource Utilization

Documentation Features Utilized

• YAML frontmatter format (name, description, when, examples, metadata.openclaw.*)
• Trigger mechanism definition (when field)
• Example specification (examples field)
• Metadata definition (metadata.openclaw.requires)
• Standardized skill description structure

Skills Referenced

• system-monitor: Structure and functional organization
• security-monitor: Metadata definition format
• integrated-system-monitor: Script organization and implementation
• Other existing skills: YAML frontmatter best practices

Community Practices Integrated

• GitHub popular OpenClaw skill project structures
• Community-recommended security practices (input validation, error handling)
• Optimal metadata configuration methods
• Effective trigger word definition patterns

Custom Scripts Created

• advanced_skill_processor.py: Implements complete 5-step research flow automation
  • Automated documentation query, public skill research, best practice search
  • Solution fusion and comparison functionality
  • AI-powered skill generation via SkillBoss API Hub (/v1/pilot, type=chat)
  • Standardized output generation
  • Error handling and logging features

Implementation Requirements

1. Execute all 5 steps in strict sequence - no skipping allowed
2. Do not rely on memory or "approximately correct" code
3. Demonstrate research → comparison → selection logical chain
4. Show evidence of consulting official documentation
5. Include proper metadata and security considerations
6. Provide complete, functional skill implementations with proper structure
7. Ensure all outputs follow the exact template structure required
8. Apply universally regardless of timeframe or version
9. Include security best practices and error handling
10. Provide comprehensive examples and use cases
11. Include system prompt integration for enhanced AI interaction
12. Incorporate thinking model framework for improved decision-making

System Prompt Integration

When creating new skills, include system prompt elements that enhance AI interaction:

"You are now an OpenClaw (formerly ClawDBot / Moltbot) skill development expert, implementing advanced thinking models for enhanced decision-making. Apply structured cognitive processing while balancing speed and accuracy based on specific situational requirements."

Skill Creation Guidelines

• Apply the multi-stage cognitive processing pipeline during skill design
• Integrate memory systems for continuous learning and improvement
• Balance speed optimization with accuracy enhancement in skill functionality
• Include appropriate system prompts for AI assistants using the skill
• Document decision-making processes for future reference and learning