← Back to Skills Marketplace
306
Downloads
0
Stars
0
Active Installs
4
Versions
Install in OpenClaw
/install undertow
Description
Skill discovery engine for AI coding agents. Recommends and installs the right skill when you need it — code review, test generation, debugging, commit messa...
Usage Guidance
This skill appears to do what it says: it recommends and installs other developer-focused skills via the ClawHub CLI and uses a bundled index.json plus lightweight workspace fingerprinting (existence checks only). Before installing: 1) Ensure the clawhub CLI on your system is the official/trusted client, since Undertow delegates installs and searches to it. 2) Be prepared to inspect any discovered skill before consenting to install — some listed skills (e.g., ones advertising autonomous behavior) may request broader access once installed. 3) Note that user queries are embedded into shell commands for search; confirm the runtime properly escapes inputs if you accept automatic searching. 4) If you have high-sensitivity repos, consider whether allowing the agent to run workspace scans or install skills is appropriate. Overall the package is coherent and proportionate to its description.
Capability Analysis
Type: OpenClaw Skill
Name: undertow
Version: 0.2.2
The 'undertow' skill is a discovery and management tool for other OpenClaw skills, acting as a curated package manager. It uses the 'clawhub' CLI to search for and install skills, but includes significant safety guardrails: it requires explicit user confirmation for both installation and invocation, and it performs a post-install security check that blocks any skill containing executable files (.sh, .py, .bin, etc.). The 'Project Fingerprint' feature is limited to checking for the existence of configuration files to improve recommendation relevance without reading their contents, and the overall logic is transparent and aligned with its stated purpose.
Capability Assessment
Purpose & Capability
Name/description, the bundled index.json, and runtime instructions all describe a skill-discovery engine that recommends and installs other skills. The declared requirement (clawhub binary) matches the documented use of 'clawhub search' and 'clawhub install'. There are no unrelated environment variables, config paths, or unexpected capabilities requested.
Instruction Scope
Instructions operate on the bundled index.json, check which skills are installed (ls ~/.cursor/skills/*/SKILL.md), and scan the workspace for the existence of common project files (package.json, Dockerfile, .env, etc.). The SKILL.md states it checks for existence only and does not read file contents. It will run the ClawHub CLI with the user's request as the search query and will prompt before installing. Be aware that embedding user text into shell commands (clawhub search "{user's request}") can be a vector for injection if not properly escaped/sanitized by the runtime; this is a common operational concern rather than a sign of misdirection.
Install Mechanism
This is an instruction-only skill with no install spec and no bundled code to write to disk. It relies on an existing clawhub CLI on PATH. That is the lowest-risk install model and consistent with its purpose.
Credentials
No environment variables, credentials, or protected config paths are requested. The only workspace access described is file-existence checks and listing installed skills, which are proportionate to recommending relevant skills.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent inclusion. It installs other skills only after user confirmation. Nothing in the instructions indicates it will modify other skills' configs or claim broader agent privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install undertow - After installation, invoke the skill by name or use
/undertow - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.2
**Major update: Now supports project fingerprinting and live skill search via ClawHub for enhanced recommendations.**
- Adds project fingerprinting by scanning for stack-related files at session start, tailoring skill suggestions to the detected stack.
- Introduces live ClawHub search fallback when no curated skills match user requests, expanding discoverability.
- Improves skill install verification: checks for unexpected executables and valid SKILL.md frontmatter before invocation.
- Updates recommendation phrasing to consider project context and distinguish between curated, rising, and live-discovered skills.
- The curated index remains bundled, with live search covering new skills and broader tasks.
v0.2.1
- Updated required command-line dependency from git to clawhub in the skill metadata.
- No changes to skill logic or behavior.
v0.2.0
Security hardening: remove npx, add double-consent model, add Security section documenting install writes markdown only
v0.1.0
V1: Curated index of 16 developer workflow skills with intent-based discovery
Metadata
Frequently Asked Questions
What is Undertow?
Skill discovery engine for AI coding agents. Recommends and installs the right skill when you need it — code review, test generation, debugging, commit messa... It is an AI Agent Skill for Claude Code / OpenClaw, with 306 downloads so far.
How do I install Undertow?
Run "/install undertow" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Undertow free?
Yes, Undertow is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Undertow support?
Undertow is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Undertow?
It is built and maintained by 8co (@8co); the current version is v0.2.2.
More Skills