skill-setup-flow

为已安装技能创建标准化设置流程，包括目录结构、配置模板、核心文件更新和设置日志记录。

This skill is a documentation-driven meta-tool and appears to do what it says: read a skill's docs and create standard local files and integration notes. Before you run it, do these simple checks: (1) review the SKILL.md/setup-template.md contents so you know exactly which files will be created/modified and where; (2) back up SOUL.md, AGENTS.md, MEMORY.md (or any global core files) before allowing automated edits; (3) never put real API keys, passwords, or other secrets into config.md or other plaintext files created by the template—use a secret store or encrypted storage instead; (4) because the skill source/homepage are unknown, prefer running it in a sandbox or inspect/grep the files in the skill package yourself before using any included automation scripts; and (5) if you want to automate execution, inspect any suggested shell scripts (setup-*.sh) and run them step-by-step rather than blindly executing them.

Type: OpenClaw Skill Name: skill-setup-flow Version: 1.0.0 The skill is a meta-utility designed to automate the configuration of other skills by creating directory structures and modifying core agent files like SOUL.md and AGENTS.md. It is classified as suspicious because it contains a potential shell injection vulnerability in SKILL.md and setup-template.md, where the {skill-name} variable is used directly in shell commands (e.g., mkdir -p) without sanitization instructions. Furthermore, the ability to programmatically rewrite the agent's core behavioral instructions (SOUL.md) represents a high-risk capability that could be leveraged for persistence or behavioral manipulation, despite appearing benign in this specific context.