skillnet

Search, download, create, evaluate, and analyze reusable agent skills via SkillNet — the open skill supply chain for AI agents. Use when: (1) Before any mult...

This skill appears to implement what it says, but proceed cautiously: - Verify the 'skillnet-ai' package before installing: check its PyPI page and source repository to confirm the maintainer and review the code. Installing arbitrary PyPI packages can execute code on your machine. - Confirm the API host(s) you'll interact with: the documentation lists api-skillnet.openkg.cn as the public search API and lets you set BASE_URL for your LLM endpoint. If you will send skill or document content to an LLM, prefer a local BASE_URL (e.g., a local vLLM) for sensitive data. - Do not provide long‑lived or highly privileged credentials without understanding scope. API_KEY is required for create/evaluate/analyze; the SKILL.md instructs one‑shot injection but double‑check you’re not exporting keys to persistent files. - Be cautious about using any 'mirror' option for GitHub downloads — a mirror could route content through an untrusted server. Prefer direct GitHub API downloads and review files locally before loading them into the agent context. - There is a small metadata inconsistency: the registry lists no required env vars while the skill requires API_KEY; confirm this before running commands that prompt for keys. - Inspect the included scripts (scripts/skillnet_create.py and skillnet_validate.py) — they appear benign and offline, but the actual network behavior depends on the 'skillnet-ai' package which the scripts import. Only run commands after you’ve reviewed the package and confirmed you trust the endpoints. If you are comfortable verifying the package origin and using one‑time API key injection (or a local LLM), the skill is reasonable. If you cannot verify the upstream package or you must handle sensitive documents, decline to install or use a local BASE_URL and review all generated files before executing anything.

Type: OpenClaw Skill Name: skillnet Version: 2.0.3 The skillnet bundle provides a comprehensive framework for managing AI agent skills, including searching, downloading, and creating new skills. The bundle demonstrates a strong security posture by including explicit guardrails in SKILL.md and security-privacy.md that instruct the agent to treat all downloaded content as untrusted, require user confirmation for sensitive actions, and avoid executing third-party scripts automatically. The provided Python scripts (skillnet_create.py and skillnet_validate.py) are transparent wrappers for the skillnet-ai library and do not contain any evidence of malicious intent, data exfiltration, or unauthorized credential usage. All network communication is directed to legitimate services such as GitHub or the user's specified LLM endpoint.