skill-expert-skills
v1.0.1Creates, optimizes, validates, and packages AI Agent Skills (SKILL.md format). Mandatory 6-Phase workflow with quality gates: Phase 0: Task Classification +...
⭐ 0· 245·4 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description promise (create/optimize/validate/package SKILL.md-based skills) aligns with the included scripts (init_skill, quick_validate, universal_validate, package_skill, analyze_trigger, diff_with_official, etc.) and the many reference docs. The skill does not request unrelated environment variables or credentials.
Instruction Scope
SKILL.md describes multi-phase workflows and explicitly tells the agent to use local docs, scripts, and (when available) external research tools (web search / URL fetch). The frontmatter lists allowed-tools (Read Write Bash Grep Glob), and the included scripts perform filesystem operations (create SKILL.md, read/write directories, package files). This is expected for a skill-creator tool, but be aware the instructions suggest using network-based research tools when available — the skill does not declare network access or credentials, so network use depends on the agent environment rather than the skill itself.
Install Mechanism
There is no install spec (instruction-only SKILL.md), which lowers automatic risk. However documentation/quick-navigation instructs users to run pip install -r scripts/requirements.txt; a requirements.txt exists (content not shown here). Running those commands would pull external packages. The repository itself contains many local Python scripts; packaging code writes zip files locally. There are no downloads from arbitrary URLs in the provided scripts.
Credentials
The skill declares no required env vars, no primary credential, and no config paths — appropriate for a tooling/authoring skill. The scripts legitimately need local filesystem access to create/validate/package skills; no sensitive or unrelated credentials are requested.
Persistence & Privilege
always:false and user-invocable:true (default) — the skill does not demand forced/global inclusion. The scripts create or modify files under user-specified skill directories (init_skill, package_skill), which is expected behavior for an authoring tool. The skill does not attempt to modify other skills' configurations or claim system-wide privileges.
Assessment
This package appears coherent with its stated purpose, but take standard precautions before running code: 1) Review scripts (scripts/*.py) and requirements.txt yourself to ensure they do only what you expect. 2) Run any pip install commands inside an isolated virtualenv and not as root. 3) Be aware the tool will read and write files under the skill directories you point it at (init_skill, package_skill), so avoid pointing it at system or secrets directories. 4) If you do not want an agent to run these scripts autonomously, keep model-invocation disabled for this skill in your agent settings. 5) If you plan to allow network access, note SKILL.md recommends web searches/URL fetch — consider whether that is acceptable in your environment.Like a lobster shell, security has layers — review code before you run it.
latestvk976hk8d1vaxwytb8ssjq20vsx82czc6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.