CatchClaw

Search, install, and export agentars from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates.

MIT-0 · Free to use, modify, and redistribute. No attribution required.

⭐ 0 · 17 · 0 current installs · 0 all-time installs

bykissrain@lovelcp

MIT-0

Security Scan

VirusTotal

Pending

View report →

OpenClaw

Suspicious

medium confidence

ℹ

Purpose & Capability

Name/description match the code and instructions: the bundled Node CLI implements search, install, export, and rollback and requires node and access to ~/.agentar and OpenClaw workspaces. One inconsistency: the registry metadata marks AGENTAR_API_BASE_URL and AGENTAR_HOME as required env vars, while SKILL.md states both are optional and have defaults — this mismatch should be corrected.

ℹ

Instruction Scope

SKILL.md instructs the agent to run the bundled CLI after a mandatory verification step (node <skill-dir>/agentar_cli.mjs version) and to prompt the user before destructive actions. The CLI reads/writes the declared paths (~/.agentar, ~/.openclaw/workspace, ~/.openclaw/agentar-workspaces, ~/agentar-exports). It also documents writing a skills/.credentials file inside the skill workspace when --api-key is used — this persists secrets inside the skill directory. Those read/write actions are necessary for the stated functionality but are high-privilege and should be explicitly consented to by the user.

ℹ

Install Mechanism

Registry has no formal install spec (instruction-only), but the package contains install.sh which downloads a tarball from a GitHub releases URL (https://github.com/OpenAgentar/catchclaw/releases/...). The download host is a GitHub releases URL (reasonable), but the presence of an install script that can fetch and run a remote installer (and which can be overridden by AGENTAR_KIT_URL) increases risk if run blindly. The skill currently asks the operator to verify the bundled CLI before use, which mitigates accidental execution of the installer.

Credentials

Requested environment variables (AGENTAR_API_BASE_URL, AGENTAR_HOME) are relevant to the CLI. However, the registry declares them as required while SKILL.md says they are optional — incoherent. The CLI can optionally store API keys into a skills/.credentials file within the skill directory when run with --api-key; storing user secrets inside the skill folder is unusual and increases risk of accidental disclosure or reuse by other skills. The CLI also accesses PATH and system variables to find 'openclaw' (expected), but these are standard.

Persistence & Privilege

The skill is not 'always:true' (good) and does not request elevated OS privileges, but it does read/write the user's primary agent workspace (~/.openclaw/workspace), can overwrite it (with backup), and writes backups to ~/.agentar/backups. Those are powerful actions appropriate to an installer manager but deserve explicit user confirmation and careful review. The SKILL.md includes user-interaction gates (verify CLI, ask mode) which reduce risk if followed.

What to consider before installing

This skill appears to implement the advertised agentar manager, but review these points before installing or running it: - Verify the bundled CLI yourself: run node <skill-dir>/agentar_cli.mjs version and inspect agentar_cli.mjs. SKILL.md requires this verification before any install/export/rollback. - Backup your OpenClaw workspace (~/.openclaw/workspace) before using install --overwrite or rollback; the CLI can overwrite your main workspace (it does create backups, but you should have your own copy). - Avoid supplying an API key unless you trust the source: the CLI may save an API key to a skills/.credentials file inside the skill directory, which persists secrets in the skill install path (unusual and potentially accessible by other local processes/users). - The repository contains install.sh that downloads a tarball from a GitHub release. Do NOT run that installer blindly; inspect the downloaded content or prefer using the bundled agentar_cli.mjs shipped with the skill. - The registry metadata and SKILL.md disagree about whether AGENTAR_API_BASE_URL and AGENTAR_HOME are required — treat them as optional defaults unless you have a reason to override them. If you want to proceed: inspect agentar_cli.mjs and install.sh locally, confirm the CLI version, and only run commands after explicit user consent for any operation that may overwrite ~/.openclaw/workspace or write credentials.

Like a lobster shell, security has layers — review code before you run it.

Current versionv3.5.8

Download zip

latestvk9721w4m6b528zrfpfzjpbehjx83mdmc

License

MIT-0

Free to use, modify, and redistribute. No attribution required.

Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📦 Clawdis

Binsnode

EnvAGENTAR_API_BASE_URL, AGENTAR_HOME

Config~/.agentar, ~/.openclaw/workspace, ~/.openclaw/agentar-workspaces, ~/agentar-exports

SKILL.md

CatchClaw Agentar Manager

Source: This skill is from the CatchClaw skill repository.

An agentar is a distributable agent archive (ZIP) containing workspace files such as SOUL.md, skills, and other configuration. It can be installed as a new agent or used to overwrite an existing agent with a single command.

Trigger Conditions

User asks to search / find / browse agentars
User asks to install / download a specific agentar
User asks to export / package an agent as an agentar
User asks to rollback / undo / restore a previous agent workspace
User mentions the keyword "agentar" or "catchclaw"

Important: Before performing any action, verify the bundled CLI works (see CLI Setup). Do not run search, install, export, or rollback until verification passes.

CLI Setup (mandatory — run before any command)

<HARD-GATE> **Before running any search, install, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is needed.

Locate: The CLI is at the same directory as this SKILL.md (e.g. ~/.agents/skills/catchclaw/agentar_cli.mjs).
Verify: Run node <skill-dir>/agentar_cli.mjs version. Only after it succeeds, proceed with search/install/export/rollback.

Never run $CLI search, $CLI install, $CLI export, or $CLI rollback until verification passes. </HARD-GATE>

CLI Location

The CLI is bundled in this skill's directory. Run it directly:

node <skill-dir>/agentar_cli.mjs <command>

Where <skill-dir> is the directory containing this SKILL.md (e.g. ~/.agents/skills/catchclaw/).

All commands below use $CLI as shorthand for node <skill-dir>/agentar_cli.mjs.

Environment Variables (optional)

These are listed in metadata.openclaw.requires.env for registry/security analysis. Neither is required for normal use; omit both to use defaults.

AGENTAR_API_BASE_URL — Override the default API base URL (defaults to https://catchclaw.me)
AGENTAR_HOME — Override the default CLI config directory (defaults to ~/.agentar)

Paths read or written by the bundled CLI

Aligned with metadata.openclaw.requires.config and metadata.json in this skill:

Path	Access	Purpose
`~/.agentar/`	read/write	CLI config (`config.json`), optional standalone install copy of `agentar_cli.mjs`
`~/.openclaw/workspace`	read/write	Main agent workspace (`install --overwrite`, export)
`~/.openclaw/agentar-workspaces/`	read/write	Per-agent workspaces (`install --name …`)
`~/agentar-exports/`	write	Default directory for `export` ZIP output
`<skill-dir>/skills/.credentials`	write (optional)	Written when install is run with `--api-key`

Commands

Search

$CLI search <keyword>

Search the CatchClaw marketplace for agentars matching the keyword.

Install

$CLI install <slug> --name <name> [--api-key <key>]
$CLI install <slug> --overwrite

Install an agentar from the marketplace.

Options:

--name <name> — Create a new agent with the given name. Existing agents are not affected. (Preferred; list this option first when prompting.)
--overwrite — Overwrite the main agent (~/.openclaw/workspace). Existing workspace is backed up automatically. Never use without the user's explicit selection.
--api-key <key> — (Optional) API key to save into skills/.credentials for agentars that require backend authentication.

Export

$CLI export [--agent <id>] [-o <path>] [--include-memory]

Export an agent as a distributable agentar ZIP package. MEMORY.md is excluded by default. Output defaults to ~/agentar-exports/. Sensitive files (.credentials, .env, .secret, .key, .pem) are automatically filtered out.

Options:

--agent <id> — Agent ID to export. If the user did not specify an agent, you MUST list agents and ask the user to choose before running export; do not export without the user's selection.
-o, --output <path> — Output ZIP file path.
--include-memory — Include MEMORY.md in export (excluded by default).

Rollback

$CLI rollback
$CLI rollback --latest

Restore a workspace from backup. Without --latest, lists all available backups for selection. The current workspace is automatically backed up before restoring, so rollback is always safe.

Version

$CLI version

Show the CLI version.

Installation Rules

<HARD-GATE> Before executing `install`: 1. **Slug required:** If the user wants to install an agentar but has not specified which one (no slug), prompt the user to enter the agentar name/slug to install. Do NOT run install without a slug. 2. **Mode confirmation (CRITICAL - MUST ASK USER):** You MUST explicitly ask the user to choose the installation mode. Do NOT proceed with installation until the user has made a clear choice. **NEVER assume or default to any mode without user confirmation.**

Present the following two options to the user and wait for their response:

new — Create a new agent. The existing agents are not affected.
overwrite — Overwrite the main agent (~/.openclaw/workspace). The existing workspace will be backed up automatically.

Important:

Do NOT execute install until the user explicitly selects one of the above options
Do NOT use "new" as a default without asking
Do NOT use "overwrite" unless the user explicitly selects it
If the user chooses "new" but doesn't specify a name, use the slug as the default name

After the user explicitly selects "new", execute: $CLI install <slug> --name <user-specified name> After the user explicitly selects "overwrite", execute: $CLI install <slug> --overwrite

Never execute install without both: (1) a slug, and (2) explicit user confirmation of installation mode. </HARD-GATE>

Export Rules

<HARD-GATE> **When the user has not specified which agent to export, you MUST let the user choose first. Do NOT export on your own.** If `--agent <id>` was not provided by the user: 1. Run `$CLI export` without `--agent` to list available agents (or equivalent to show choices). 2. Present the list to the user and ask which agent to export. 3. Only after the user explicitly selects an agent, run `$CLI export --agent <user-selected-id>` (and optional `-o`, `--include-memory` as needed). Never assume or pick an agent for the user. </HARD-GATE>

MEMORY.md is excluded by default. Only include it if the user explicitly requests it with --include-memory.
Sensitive files are automatically filtered out during export (.credentials, .env, .secret, .key, .pem).
After a successful export, remind the user to review the exported ZIP for any sensitive data (API keys, credentials, personal information).
Export is a purely local operation — it does not require network access.

Error Handling

Error	Action
CLI file not found	Verify the skill is installed correctly — `agentar_cli.mjs` should be in the skill directory
API unreachable or network error	Suggest checking network connectivity, or override the API URL with: `export AGENTAR_API_BASE_URL=<url>`
Node.js not installed	Instruct user to install Node.js from https://nodejs.org/
Download or extraction failure	Show the error message and suggest retrying the command

Workflow

Search: Run $CLI search <keyword> to find agentars. Each result includes a slug identifier.
Install: If the user did not specify which agentar to install (no slug), ask the user to enter the agentar name/slug. Then confirm installation mode: present [1] new, [2] overwrite; never use overwrite without explicit user selection. Only after you have both slug and mode, execute the install command.
Export: If the user did not specify which agent to export, run $CLI export (no --agent) to list agents, present the list to the user, and ask them to choose. Only after the user selects an agent, run $CLI export --agent <id>. Do not export without the user's explicit selection.
Rollback: If the user wants to undo an overwrite install, run $CLI rollback to list available backups and restore one.

Files

3 total

Select a file

Select a file to preview.

Comments

Loading comments…