Skills Finder

Intelligent skill matcher that searches multiple skill marketplaces (ClawHub & Skills.sh) in real-time. Supports ANY language for user input, multi-step skil...

Security Scan

The skill's functionality (searching/installing skills) is coherent, but there are inconsistencies in declared requirements and it relies on running unpinned npx packages (@latest) at runtime — a moderate risk you should review before installing.

Purpose & Capability

The name/description (search and install skills from ClawHub & Skills.sh) align with the script and SKILL.md which call npx clawhub and npx skills. However registry-level 'Requirements' in the provided header claim no required binaries, while SKILL.md and _meta.json require Node.js/npx (and jq/curl). That metadata mismatch is a coherence issue and should be clarified.

Instruction Scope

SKILL.md and scripts only instruct the agent to run marketplace CLIs (npx clawhub, npx skills) and to detect language locally. They do not request unrelated files, environment variables, or external endpoints beyond the expected package tooling. Note: the script executes npx commands which will fetch and run code from remote registries at runtime — this is in-scope for 'install' behavior but expands runtime trust (see install_mechanism).

Install Mechanism

There is no packaged install spec, but the runtime uses npx to fetch and execute clawhub@latest and skills packages. Using npx @latest implicitly downloads and runs remote code each time (no pinned versions), which increases supply-chain risk. This is an expected mechanism for this purpose but is higher-risk than a pinned or audited install. Also _meta.json lists install hints that would install npm packages; the script relies on network fetches rather than local, reviewed binaries.

Credentials

The skill does not request environment variables, credentials, or config paths. The dependencies listed (Node/npx, curl, jq) are reasonable for the described behavior and there are no unexpected secret requests.

Persistence & Privilege

The skill is not always-enabled, does not declare extra privileges, and does not modify other skills or system-wide settings. It can install other skills via npx (expected for an installer/finder), but it does not itself require persistent elevated privileges.

What to consider before installing

This skill appears to do what it says (search and install skills) but has two things to consider before installing: 1) Metadata mismatch: the registry header claims no required binaries, while SKILL.md/_meta.json require Node.js/npx (and optionally curl/jq). Confirm you have Node/npm and that the registry metadata is accurate. 2) Runtime npx usage: the script runs commands like 'npx clawhub@latest' and 'npx skills find' which download and execute code from the npm registry at runtime (and use the @latest tag). That behavior is expected for a 'finder/installer' but is a supply-chain risk — a malicious or compromised npm package (or a hijacked package name) could execute arbitrary code on your system. To reduce risk, prefer pinned versions, verify the upstream package authors (clawhub, skills), inspect those CLIs' source repositories, or run in a sandboxed environment. Also verify any skill you install via this tool before granting it broader agent permissions. Optional checks: review the referenced GitHub homepage in _meta.json, ensure clawhub/skills CLIs are the official packages you expect, and consider requesting a packaged install (pinned versions or an audit) instead of runtime @latest execution.

Intelligent skill discovery engine that searches multiple skill marketplaces and recommends the best skills for your task.

---

🎯 When to Use

Automatically triggers when user wants to find or install skills:

User Intent	Examples
Find skills	"帮我找个...", "find a skill", "buscar herramienta", "スキルを探して"
Search for capability	"有什么skill能做...", "what can you do", "有什么工具"
Install skill	"安装...", "install", "instalar", "インストール"
Get recommendations	"推荐...", "recommend", "recomendar", "おすすめ"

---

🌍 Universal Language Support

This skill supports ANY language for user input!

Supported Languages (Truly Universal)

This skill supports ALL languages and scripts including but not limited to:

Language Family	Examples
European	English, Spanish, French, German, Italian, Portuguese, Russian
Asian	Chinese (中文), Japanese (日本語), Korean (한국어), Vietnamese, Thai
Middle Eastern	Arabic, Hebrew, Persian, Turkish
South Asian	Hindi, Bengali, Tamil, Urdu
African	Swahili, Zulu, Amharic
Special	Emoji queries 📱💻🔍

---

🌐 Supported Skill Marketplaces

1. ClawHub (clawhub.ai)

npx clawhub@latest search "<query>"
npx clawhub@latest install <name>

• 5,400+ skills available
• Open-source AI assistant skills
• Rating-based recommendations

2. Skills CLI (skills.sh)

npx skills find "<query>"
npx skills add <package>

• Skills.sh - The package manager for open agent skills
• Modular packages that extend agent capabilities
• Specialized knowledge, workflows, and tools

---

⚡ Quick Commands

# Search skills (supports ANY language)
~/.openclaw/workspace/skills/skills-finder/scripts/skill-finder.sh search "your query"

# Search specific marketplace
~/.openclaw/workspace/skills/skills-finder/scripts/skill-finder.sh search "query" --source clawhub
~/.openclaw/workspace/skills/skills-finder/scripts/skill-finder.sh search "query" --source skills

# Search both (default)
~/.openclaw/workspace/skills/skills-finder/scripts/skill-finder.sh search "query" --source all

# Install from specific source
~/.openclaw/workspace/skills/skills-finder/scripts/skill-finder.sh install <name> --source clawhub
~/.openclaw/workspace/skills/skills-finder/scripts/skill-finder.sh install <package> --source skills

# List installed skills
~/.openclaw/workspace/skills/skills-finder/scripts/skill-finder.sh list

---

🔗 Multi-Step Skill Chaining

For complex tasks requiring multiple skills, the search automatically detects and suggests a skill chain.

Chain Detection

Task Type	Example	Result
Single skill	"天气skill"	Direct recommendation
Multi-step	"搜索新闻发送到微信"	Skill chain + composite suggestion

---

📋 Usage Examples

Example 1: Search Both Sources

User: 找个天气skill

→ ClawHub: weather (3.898⭐)
→ Skills: @skills/weather

Results from both marketplaces shown!

Example 2: Search Specific Source

User: find a skill for GitHub

→ Searching ClawHub only:
  - github (3.636⭐)
  - github-cli (3.538⭐)

Example 3: Multi-language

User: 天気を調べて
→ ClawHub: weather
→ Skills: @skills/weather

---

🔧 Implementation

Dual Source Search

# Search ClawHub
npx clawhub@latest search "<query>"

# Search Skills.sh
npx skills find "<query>"

# Both results merged and ranked

Source Priority

Source	Priority	Use Case
ClawHub	Default	General AI assistant skills
Skills.sh	Alternative	Specialized workflows

---

⚠️ Important Notes

Why Two Sources?

1. ClawHub - Large collection of AI assistant skills (5,400+)
2. Skills.sh - Specialized workflows and tools for agents

Both are searched by default for comprehensive results.

Rate Limits

• ClawHub: 60 requests/hour (logged in: higher)
• Skills.sh: Check with npx skills --help

---

📦 Dependencies

• Node.js + npx
• curl
• jq

---

🦞 Summary

One line: User writes in ANY language → Search both ClawHub & Skills.sh → Respond in user's language → Suggest chain for complex tasks

---