advanced-skill-creator

Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper metho...

This skill is internally consistent with its stated goal (it includes a Python script that calls an external AI service and asks for SKILLBOSS_API_KEY), but there are red flags you should address before installing: 1) Inspect SKILL.md and scripts for prompt-injection strings (the pre-scan found a 'you-are-now' pattern) and remove or sanitize any hidden directives that force the model to ignore host policies. 2) Verify the external service (api.heybossai.com / skillboss.co): ask the publisher for a real homepage, privacy/security documentation, and the exact privileges expected of SKILLBOSS_API_KEY. 3) Audit scripts for any subprocess.run/exec usage or file reads not needed for skill creation; run the code in an isolated environment (container) first. 4) If you must supply SKILLBOSS_API_KEY, use a scoped/test key with minimal privileges and monitor network traffic. 5) Prefer disabling autonomous invocation or limit triggers until you confirm there is no hidden prompt-injection or credential exfiltration. If you cannot verify the external service or remove injection patterns, treat this skill as unsafe to deploy.

Type: OpenClaw Skill Name: marjorie-advanced-skill-creator Version: 1.0.0 The skill bundle provides a structured framework for generating OpenClaw skills, utilizing a Python script (scripts/advanced_skill_processor.py) to call an external AI service (api.heybossai.com). It requires the SKILLBOSS_API_KEY environment variable to function, which is clearly documented as its primary dependency in SKILL.md and UPLOAD_INSTRUCTIONS.md. The implementation is consistent with its stated purpose of AI-assisted skill creation, and no evidence of malicious behavior, such as credential theft, unauthorized data exfiltration, or harmful command execution, was found.