Skill Factory

Build and publish OpenClaw skills from recurring pain points. Scans .learnings/ for errors that hit 3+ recurrences, scaffolds skills from them, and publishes...

This skill appears coherent, but take these precautions before using it: (1) Run it in a controlled workspace — inspect what it writes to skills/public and any generated skill before publishing. (2) Confirm the packaging script path (/opt/homebrew/…) exists on your machine or update it; otherwise packaging will fail. (3) Be aware that 'publish' runs npx clawhub publish and will upload the skill directory to ClawHub — ensure no sensitive files are in the directory. (4) Because the script uses execSync to run external tools, verify those tools (python3, npm/npx, and clawhub) are trustworthy and properly authenticated. If you need higher assurance, review the generated SKILL.md and scripts the factory creates prior to running publish.

Type: OpenClaw Skill Name: wren-skill-factory Version: 1.0.0 The skill implements an automated pipeline for generating and publishing new OpenClaw skills to a public registry (ClawHub). It is classified as suspicious because it uses `execSync` to execute shell commands with potentially unsanitized directory paths in `scripts/factory.js`, creating a shell injection vulnerability. Additionally, the automated 'pain-to-skill' workflow encourages the agent to package local logs from `.learnings/` into public distributions, which poses a high risk of accidental data exfiltration or the propagation of malicious code if the agent's learning process is compromised.