Remote Skill Installer

This tool mostly does what it says: it downloads SKILL.md files and stores them under ~/.openclaw workspaces. Before installing or importing skills, consider: 1) Verify sources — prefer official hub URLs and inspect downloaded SKILL.md files before enabling/executing them, because the installer saves files verbatim. 2) The code claims SSRF protection but the hostname check only blocks literal IP addresses; it does not perform DNS resolution to detect if a hostname resolves to a private IP, so SSRF protections are weaker than advertised. Treat custom URLs cautiously and consider restricting network egress. 3) The script computes and stores a SHA256-derived checksum but does not verify files against a known trusted signature — checksum is informational, not an authenticity check. 4) SKILL.md mentions XXE/RSS protections, but there is no RSS parsing code in the installer — that claim is misleading. 5) If you will use this in sensitive environments, prefer to: (a) audit the script locally, (b) run it in a restricted environment/container, (c) restrict which domains it may fetch from (allowlist), and (d) review any installed SKILL.md before enabling the skill. These gaps make the package suspicious but not outright malicious; the issues could be sloppy implementation or overpromising documentation rather than intentional misdirection.