Skill Picker
v1.0.3Discovers and recommends the best agent skills based on user intent — not just keywords. Activates when users ask "how do I do X", "find a skill for X", "is...
⭐ 1· 219·0 current·0 all-time
by@yao00oo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (skill discovery & recommendation) match the runtime behavior: the SKILL.md instructs the agent to run intent-aware searches and present install commands to the user. No unrelated credentials, binaries, or config paths are required.
Instruction Scope
Instructions constrain autonomous activity to a single command (npx skills find [query]) and explicitly require user confirmation for installs. The skill asks the agent to monitor session activity for repetition/friction (proactive suggestions) — this is within expected agent behavior but gives the skill discretion to surface recommendations based on conversation context. The SKILL.md does not instruct reading files, env vars, or posting data to external endpoints other than registry lookups.
Install Mechanism
This is instruction-only (no install spec). It uses npx at runtime to run a search tool. npx fetches and executes packages from the npm registry, so running npx implicitly executes code fetched from the network; however the skill limits itself to a specific subcommand (skills find) and does not perform arbitrary downloads itself.
Credentials
No environment variables, credentials, or config paths are requested. That is proportional to a registry-search/recommendation skill.
Persistence & Privilege
always is false and the skill does not request persistent privileges or attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by platform default but the skill's actions are limited and described in SKILL.md.
Assessment
This skill appears coherent: it only searches the skills registry and shows install commands for you to run. Before installing: (1) confirm you are comfortable with the agent running npx commands — npx fetches and runs code from npm, so network access will be used when the agent runs the search command; (2) verify the install commands the skill shows before you run them (the skill says it will not auto-install, but you should still review any npx skills add lines); (3) note that proactive suggestions are based on conversation/session activity — if you prefer no proactive recommendations, avoid enabling or invoking the skill. No credentials or system files are requested.Like a lobster shell, security has layers — review code before you run it.
latestvk972qdpk5p3eqzdxvhbq74kqts82sx8e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.