capability-match

AI-powered skill router that analyzes your request and recommends the best installed skill for the job

Security Scan

The skill is internally coherent: it locally scans SKILL.md files in your skills directory and recommends matches; it does not request credentials or perform network downloads, but there are minor implementation inconsistencies you should be aware of.

Purpose & Capability

The code's behavior matches the declared purpose: it discovers SKILL.md files in a local skills directory (~/.openclaw-autoclaw/skills), extracts simple metadata, computes similarity scores, and returns ranked recommendations. There are no unrelated binaries, cloud credentials, or surprising external requirements.

Instruction Scope

SKILL.md promises to "analyze each skill's capabilities from its SKILL.md"; the implementation does this but in a limited way (it only extracts frontmatter name/description and triggers from specific sections). It only reads files under the stated skills directory and does not attempt to read other system paths. The limited parser may miss capabilities if SKILL.md files don't follow the expected structure.

Install Mechanism

No install spec or external download is present. The package is pure Node.js with no dependencies in package.json. Nothing is written to disk by an installer and no remote code is fetched.

Credentials

The skill does not require credentials or config paths. It reads HOME/USERPROFILE to locate the skills directory (expected). However, the SKILL.md and README document optional env var names (CAPABILITY_MATCH_THRESHOLD, CAPABILITY_MATCH_MAX_RESULTS) that differ from the environment variables the code actually reads (ORCHESTRATOR_THRESHOLD, ORCHESTRATOR_MAX_RESULTS). As a result, setting the documented variables will not affect runtime behavior — this is a bug/inconsistency but not a credential/privilege concern.

Persistence & Privilege

The skill does not request persistent platform privileges (always is false) and does not modify other skills or global agent settings. It only reads local SKILL.md files and returns recommendations; autonomous invocation is allowed by default but is normal for skills.

Assessment

This skill is generally safe in that it only reads local SKILL.md files and does not ask for secrets or download code. Before installing: 1) Note the env-var mismatch — if you want to tune thresholds, set ORCHESTRATOR_THRESHOLD and ORCHESTRATOR_MAX_RESULTS (the README documents CAPABILITY_* names which the code does not use). 2) Ensure you don't store sensitive secrets inside any SKILL.md files in your skills directory, because the orchestrator will read those files. 3) Be aware the parser is simplistic: ensure each skill's SKILL.md includes a frontmatter name/description and example triggers in Usage/Examples for reliable matching. If you need stronger privacy guarantees, inspect the code locally and verify no network calls were added before use.

Intelligent skill routing for OpenClaw - automatically discovers your installed skills and recommends the perfect one for any task.

Usage

Simply describe what you want to do:

Use capability match to: "create a PowerPoint presentation from sales data"

Or directly:

"capability-match: extract text from this PDF and summarize it"

What It Does

1. Discovers all installed skills from your skills/ directory
2. Analyzes each skill's capabilities from its SKILL.md
3. Matches your natural language request to the most relevant skills
4. Recommends top 3 options with reasoning

Features

• ✅ Automatic skill discovery - scans skills/ directory
• ✅ Smart matching - understands intents, not just keywords
• ✅ Ranked recommendations - with confidence scores
• ✅ Zero config - works out of the box
• ✅ Lightweight - pure Node.js, no external dependencies

Commands

The matcher recognizes these trigger phrases:

• use capability-match to [task]
• capability-match: [task]
• what skill should i use for [task]
• recommend a skill for [task]

Requirements

• OpenClaw with skills directory at ~/.openclaw-autoclaw/skills/
• Node.js 18+

Configuration

Optional environment variables:

• CAPABILITY_MATCH_THRESHOLD - Minimum confidence score (default: 30)
• CAPABILITY_MATCH_MAX_RESULTS - Max recommendations (default: 3)

---

Ready to intelligently route your requests? Just ask: "capability-match: [your task]"