fff

Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an exis...

This package mostly looks like a legitimate 'skill creator' template with helper scripts (init_skill, package_skill, quick_validate) and tests. Before installing or executing any bundled scripts: - Be aware of metadata mismatches: the registry name ('fff' / 'skill-vetter1') does not match SKILL.md ('skill-creator1') and skillhub.json versions differ; this is likely sloppy packaging but verify the author/source before trusting it. - SKILL.md contains a 'tags' frontmatter key that the included quick_validate.py will treat as unexpected and may cause validation to fail; tests in the package mock/bypass the validator — don't rely on tests as evidence that packaging will succeed. - The code manipulates the filesystem (reads/writes skill directories, creates .skill zip archives). Review package_skill.py and init scripts before running them to ensure they won't operate on paths you don't intend. - There are duplicate/translated directories (测试中文/) and duplicated files; this is likely benign but increases the chance of stale or inconsistent code. Prefer running these scripts in an isolated environment (tempdir or container) and inspect the SKILL.md + quick_validate.py first. If you need to package skills with this tool: either remove/adjust the unexpected frontmatter keys or update the validator to accept them, and run in an isolated environment. If you want higher assurance, ask the publisher for a canonical source (single consistent SKILL.md and matching metadata) and for clarification about the duplicated files.

Type: OpenClaw Skill Name: skill-vetter1 Version: 1.0.4 The bundle is a legitimate toolkit designed to help an AI agent create, validate, and package other OpenClaw skills. It contains instructional documentation (SKILL.md) and utility scripts (package_skill.py, quick_validate.py, and a Chinese-named initializer) that align perfectly with the stated purpose. Notably, the packaging script includes defensive security logic to skip symlinks and verify that files remain within the skill root, preventing potential path traversal or arbitrary file inclusion during the build process. No indicators of data exfiltration, malicious execution, or harmful prompt injection were found.