Skill Extractor

Export any installed OpenClaw skill into a shareable ZIP: detects & stages external runtime files, generates STRUCTURE.md for LLM-guided install. Reads and p...

This skill appears to do what it says: export a skill plus any external files referenced by its SKILL.md. Important things to consider before using it: (1) The tool will package files exactly as-is — that can include credentials, tokens, or other sensitive user data referenced by the skill; carefully review the detected external file list when prompted and abort if anything sensitive is present. (2) Be cautious exporting third-party/untrusted skills: an attacker could put references to sensitive paths (e.g., ~/.aws/credentials) in a SKILL.md to trick you into packaging secrets; do not confirm packaging unless you understand each listed path. (3) Confirm the target ZIP path before overwriting existing files (default is Desktop). (4) If you need to share a skill but not secrets, consider sanitizing or excluding external files and documenting runtime-generated placeholders in STRUCTURE.md instead.

Type: OpenClaw Skill Name: skill-extractor Version: 1.8.1 The skill-extractor (SKILL.md) is a utility designed to package OpenClaw skills into ZIP files, but it includes high-risk functionality that automatically scans for and stages 'external files' from the user's home directory and app-data folders based on path-like strings found in documentation. While the instructions explicitly require the agent to warn the user about sensitive data (credentials, tokens) and obtain confirmation before zipping, the broad capability to access and package arbitrary files outside the skill directory based on AI interpretation of markdown text creates a significant risk for accidental data exposure or exploitation via malicious path references in other skills.