Unified Find Skills

Helps users discover and install agent skills from skills.sh, clawhub.com, and tessl.io. Use when the user asks to find a skill for a task, extend agent capa...

This skill appears to do what it says: search registries and suggest install commands. Before running any suggested install commands (npm install -g, npx skills add, tessl/clawhub installs, or curl pipelines), review the package source and repository links yourself. Global installs and automated flags (-g, -y) install code from the network without prompting—consider installing in a sandbox or with a non-root user, and avoid blindly piping curl to shell. If you want additional assurance, ask the skill to first show the exact repository/URL and README for each candidate skill before performing any install.

Type: OpenClaw Skill Name: unified-find-skills Version: 1.0.0 This skill is classified as suspicious due to its core functionality involving the installation of external agent skills and CLIs from third-party registries (skills.sh, clawhub.com, tessl.io, npm) via commands like `npx skills add`, `clawhub install`, `tessl install`, and `npm install -g`. While this is the stated purpose of the skill, it introduces a significant supply chain risk, as it enables the agent to fetch and execute arbitrary code from untrusted or potentially compromised sources. The `SKILL.md` also instructs the agent to use `curl` for web scraping, involving network access and command piping. There is no direct evidence of intentional malicious behavior (e.g., data exfiltration, backdoor installation) within this specific skill bundle itself, but its powerful capabilities present a high-risk attack surface if misused or if the external registries are compromised.