Openclaw Skill Marketplace

OpenClaw 技能市场 - 从 ClawHub 同步 100+ 技能，智能推荐最适合你的技能组合。 支持场景推荐（开发/创作/办公）、行业推荐（互联网/金融/教育）、身份推荐（开发者/设计师/学生）。 增强搜索：精确搜索、模糊搜索、中文关键词映射（如"备份"搜到"backup"）。 浏览、搜索、一键安装、评分...

Security Scan

The package does what its name/description claim (a local skill marketplace that lists, searches, recommends and calls ClawHub to install/sync skills); nothing in the code requests unrelated credentials or hidden endpoints, but the documentation contains minor contradictory statements about external downloads and the scripts rely on npx (which will fetch code at runtime).

Purpose & Capability

Name/description match the included files: scripts implement browsing, enhanced search, recommendations, syncing from ClawHub, and installing via the ClawHub CLI. The required resources (reading ~/.openclaw/workspace/skills, writing a synced-skills.json, calling npx clawhub) align with a skill marketplace.

Instruction Scope

Runtime instructions (SKILL.md and scripts) operate on local skill metadata under ~/.openclaw/workspace/skills and display/install items. They explicitly call external tooling via 'npx clawhub' for explore/install operations (sync/install will network). The instructions do not attempt to read unrelated system files or environment variables. The only scope confusion is a documentation claim that there is 'no external download' while the scripts and docs also acknowledge that npx/clawhub will download skills—this is a documentation inconsistency rather than hidden behavior.

Install Mechanism

There is no package-install spec (instruction-only skill) and all Python scripts are bundled. At runtime the scripts invoke 'npx clawhub ...' which will fetch/execute code from the npm registry (via npx) and download skills from the ClawHub registry. This is expected for a marketplace but means remote code will be pulled at runtime via npx rather than being fully self-contained.

Credentials

The skill declares no environment variables, credentials, or config paths beyond using the user's home directory (~/.openclaw/workspace/skills). The level of access (reading skill SKILL.md files and writing synced-skills.json plus installing into the skills directory) is proportional to a marketplace/installer tool.

Persistence & Privilege

Skill is not marked always:true and does not modify other skills' configurations beyond installing new skill folders under ~/.openclaw/workspace/skills. It writes a synced-skills.json into its own config folder. No privileged/system-wide changes are requested.

Assessment

This skill is internally coherent for a local marketplace: it lists/searches/recommends and relies on the ClawHub CLI to fetch and install skills. Before using it: 1) Understand that install/sync commands call 'npx clawhub' which will fetch and run code from the npm/ClawHub ecosystem — only run if you trust ClawHub and the npm package. 2) Review the bundled scripts (they are included) and verify ~/.openclaw/workspace/skills permissions. 3) Note the documentation is slightly inconsistent about external downloads; assume network activity when running sync/install. 4) If you want stronger assurance, inspect the @openclaw/clawhub package source (or pin a specific verified version) before running npx, and run the install/sync commands in a restricted/testing environment first.

Skill Marketplace - 技能市场

发现和安装优质 OpenClaw 技能。

---

✨ 功能

• 🛒 技能发现 - 浏览/搜索技能
• ⭐ 评分评论 - 用户评分和评论
• 📊 排行榜 - 下载量/评分排行
• 🔔 更新提醒 - 技能更新通知
• 📦 一键安装 - 自动下载安装

---

🚀 安装

# 技能已安装在：~/.openclaw/workspace/skills/skill-marketplace

---

📖 使用

🔄 从 ClawHub 同步技能（v1.2.0 NEW!）

# 同步 ClawHub 所有技能（默认 100 个）
python3 skill-marketplace/scripts/sync-from-clawhub.py

# 同步更多技能
python3 skill-marketplace/scripts/sync-from-clawhub.py --limit 500

# 同步后查看摘要
# 自动显示：技能总数、分类统计、Top 5 热门

🎯 智能推荐

# 根据场景推荐
python3 skill-marketplace/scripts/recommend.py --scenario "开发编程"

# 根据行业推荐
python3 skill-marketplace/scripts/recommend.py --industry "互联网"

# 根据身份推荐
python3 skill-marketplace/scripts/recommend.py --role "开发者"

# 查看基础必装技能
python3 skill-marketplace/scripts/recommend.py --basic

# 查看排行榜 Top 10
python3 skill-marketplace/scripts/recommend.py --top 10

🔍 浏览和搜索

# 浏览本地技能
python3 skill-marketplace/scripts/browse.py

# 浏览 ClawHub 所有技能
python3 skill-marketplace/scripts/browse.py --from-clawhub

# 按分类浏览
python3 skill-marketplace/scripts/browse.py --from-clawhub --category automation

# 只看已安装
python3 skill-marketplace/scripts/browse.py --from-clawhub --installed

# 搜索本地技能
python3 skill-marketplace/scripts/search.py "backup"

# 搜索 ClawHub 所有技能
python3 skill-marketplace/scripts/search.py "backup" --from-clawhub

📦 安装技能

# 安装技能（从 ClawHub）
python3 skill-marketplace/scripts/install.py auto-backup

# 强制重新安装
python3 skill-marketplace/scripts/install.py model-switch --force

# 列出已安装技能
python3 skill-marketplace/scripts/install.py --list

---

作者： @williamwg2025
版本： 1.0.0

---

🔒 安全说明

代码来源 ✅

所有脚本已包含在包内：

• browse.py - 浏览技能
• search.py - 搜索技能
• install.py - 安装技能（调用 npx clawhub install）
• rankings.py - 排行榜

无外部依赖：

• ❌ 不克隆外部仓库
• ❌ 不下载外部代码
• ❌ 不执行远程脚本

网络访问

当前脚本不需要联网：

• 所有操作在本地执行
• install.py 调用 npx clawhub install 会联网下载技能（这是预期行为）

文件访问

读取：

• 本地技能列表（可选配置文件）
• 用户输入的技能名称

写入：

• 当前版本不自动写入文件
• install.py 会安装技能到 ~/.openclaw/workspace/skills/

系统操作

• install.py： 调用 npx clawhub install <skill> 安装技能
• 影响： 会在 skills/ 目录创建新文件夹

数据安全

• 本地处理： 所有操作在本地执行
• 不上传： 不发送数据到外部服务器
• 安装技能： 通过 ClawHub 官方 Registry（可信来源）

使用建议

1. 检查脚本： 所有脚本都在 scripts/ 目录，可自行审查
2. 测试运行： 先运行 browse.py 或 search.py 测试行为
3. 安装技能： install.py 会调用 ClawHub，确保信任来源
4. 权限控制： 确保 skills/ 目录权限正确

---

作者： @williamwg2025
版本： 1.0.1
许可证： MIT-0