← Back to Skills Marketplace
lovelcp

CatchClaw

by kissrain · GitHub ↗ · v3.7.5 · MIT-0
cross-platform ⚠ suspicious
506
Downloads
2
Stars
0
Active Installs
41
Versions
Install in OpenClaw
/install catchclaw
Description
Search, install, and export agentars and teams from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates or teams.
README (SKILL.md)

CatchClaw Agentar Manager

Source: This skill is from the CatchClaw skill repository.

An agentar is a distributable agent archive (ZIP) containing workspace files such as SOUL.md, skills, and other configuration. It can be installed as a new agent or used to overwrite an existing agent with a single command.

Trigger Conditions

  • User asks to search / find / browse agentars
  • User asks to install / download a specific agentar
  • User asks to export / package an agent as an agentar
  • User asks to rollback / undo / restore a previous agent workspace
  • User mentions the keyword "agentar" or "catchclaw"
  • User asks to search / install / list teams or "agenteam"
  • User asks to install a team from the marketplace
  • User asks to check team status or list installed teams

Important: Before performing any action, verify the bundled CLI works (see CLI Setup). Do not run search, install, export, rollback, or team commands until verification passes.

CLI Setup (mandatory — run before any command)

\x3CHARD-GATE> Before running any search, install, export, rollback, or team command, you MUST verify the bundled CLI. The CLI (agentar_cli.mjs) is bundled in this skill's directory — no download or copy is needed.

  1. Locate: The CLI is at the same directory as this SKILL.md (e.g. ~/.agents/skills/catchclaw/agentar_cli.mjs).
  2. Verify: Run node \x3Cskill-dir>/agentar_cli.mjs version. Only after it succeeds, proceed with search/install/export/rollback/team commands.

Never run $CLI search, $CLI install, $CLI export, $CLI rollback, or $CLI team … until verification passes. \x3C/HARD-GATE>

CLI Location

The CLI is bundled in this skill's directory. Run it directly:

node \x3Cskill-dir>/agentar_cli.mjs \x3Ccommand>

Where \x3Cskill-dir> is the directory containing this SKILL.md (e.g. ~/.agents/skills/catchclaw/).

All commands below use $CLI as shorthand for node \x3Cskill-dir>/agentar_cli.mjs.

Environment Variables (optional)

These are listed in metadata.openclaw.requires.env for registry/security analysis. Neither is required for normal use; omit both to use defaults.

  • AGENTAR_API_BASE_URL — Override the default API base URL (defaults to https://catchclaw.me)
  • AGENTAR_HOME — Override the default CLI config directory (defaults to ~/.agentar)

Paths read or written by the bundled CLI

Aligned with metadata.openclaw.requires.config and metadata.json in this skill:

Path Access Purpose
~/.agentar/ read/write CLI config (config.json), optional standalone install copy of agentar_cli.mjs
~/.openclaw/workspace read/write Main agent workspace (install --overwrite, export)
~/.openclaw/agentar-workspaces/ read/write Per-agent workspaces (install --name …)
~/agentar-exports/ write Default directory for export ZIP output
~/.openclaw/agentar-teams/ read/write Team registries (team install, team list, team status)
\x3Cskill-dir>/skills/.credentials write (optional) Written when install is run with --api-key

Critical: Install Command Selection

\x3CHARD-GATE> When the user asks to install something, you MUST determine whether it is a single agentar or a team BEFORE running any command:

  • Single agentar$CLI install \x3Cslug> --name \x3Cname>
  • Team (agenteam)$CLI team install \x3Cslug>

NEVER use $CLI install for teams. It will fail because teams are not individual agentars. If the instruction mentions "team", "agenteam", or the slug contains "team", use $CLI team install.

If unsure, run $CLI search \x3Cslug> first — the result will show the type. \x3C/HARD-GATE>

Commands

Search

$CLI search \x3Ckeyword>

Search the CatchClaw marketplace for agentars matching the keyword.

Install

$CLI install \x3Cslug> --name \x3Cname> [--api-key \x3Ckey>] [--version \x3Cver>]
$CLI install \x3Cslug> --overwrite [--version \x3Cver>]

Install an agentar from the marketplace.

Options:

  • --name \x3Cname> — Create a new agent with the given name. Existing agents are not affected. (Preferred; list this option first when prompting.)
  • --overwrite — Overwrite the main agent (~/.openclaw/workspace). Existing workspace is backed up automatically. Never use without the user's explicit selection.
  • --api-key \x3Ckey> — (Optional) API key to save into skills/.credentials for agentars that require backend authentication.
  • --version \x3Cver> — (Optional) Install a specific version. When omitted, installs the latest version.

Version conflict handling: When installing a specific version and the agent is already installed locally with a different version, the CLI will prompt:

"agent-name" (v1.0.0) is already installed. Install v1.4.0? [y/N]
  • Answer y to backup the existing version and install the new one
  • Answer N (or Enter) to abort
  • Use --overwrite to skip the confirmation prompt
  • If the existing installation has no version metadata, the prompt shows "(unknown version)"

Export

$CLI export [--agent \x3Cid>] [-o \x3Cpath>] [--include-memory]

Export an agent as a distributable agentar ZIP package. MEMORY.md is excluded by default. Output defaults to ~/agentar-exports/. Sensitive files (.credentials, .env, .secret, .key, .pem) are automatically filtered out.

Options:

  • --agent \x3Cid> — Agent ID to export. If the user did not specify an agent, you MUST list agents and ask the user to choose before running export; do not export without the user's selection.
  • -o, --output \x3Cpath> — Output ZIP file path.
  • --include-memory — Include MEMORY.md in export (excluded by default).

Rollback

$CLI rollback
$CLI rollback --latest

Restore a workspace from backup. Without --latest, lists all available backups for selection. The current workspace is automatically backed up before restoring, so rollback is always safe.

Version

$CLI version

Show the CLI version.

Team Commands

Team Search

$CLI team search \x3Ckeyword>

Search the CatchClaw marketplace for teams matching the keyword. Results include slug, name, version, and member count.

Team Install

$CLI team install \x3Cslug> [--version \x3Cver>]

Install a team and all its member agents from the marketplace.

Options:

  • --version \x3Cver> — (Optional) Install a specific version of the team. When omitted, installs the latest version. The version is passed to the backend to fetch the corresponding team manifest snapshot with pinned member versions.

Behavior:

  • Fetches the team manifest (name, members, collaboration type)
  • Installs each member agent as a new agent (or reuses if already installed locally)
  • Writes team registry to ~/.openclaw/agentar-teams/\x3Cslug>/team.yaml
  • Updates each member's AGENTS.md with team coordination block

Member version conflict handling: When a team specifies particular versions for its member agents, and a member is already installed locally with a different version, the CLI will prompt per member:

"agent-a" (v1.0.0) is already installed. Team requires v1.2.0. Upgrade? [y/N]
  • Answer y to upgrade that member agent (with automatic backup)
  • Answer N to keep the existing version and continue installing remaining members
  • Declining a member upgrade does NOT abort the entire team installation

Team List

$CLI team list

List all locally installed teams with their name, slug, version, and member count.

Team Status

$CLI team status \x3Cslug>

Show detailed status of a team: member agents, their install paths, and whether their AGENTS.md contains the team block.

Team Installation Rules

\x3CHARD-GATE> Before executing team install:

  1. Slug required: If the user wants to install a team but has not specified which one (no slug), run $CLI team search \x3Ckeyword> to help the user find the team, then ask for the slug.
  2. Confirmation (CRITICAL - MUST ASK USER): Before executing $CLI team install \x3Cslug>, you MUST inform the user:
    • "This will install team \x3Cslug> with its member agents. Existing agents with matching slugs will be reused. Proceed?"
    • Only execute after explicit user confirmation.
    • Team install creates new agent workspaces, reuses existing ones by name match, and mutates each member's AGENTS.md.

After the user confirms, execute: $CLI team install \x3Cslug>

Never execute team install without both: (1) a slug, and (2) explicit user confirmation. \x3C/HARD-GATE>

Installation Rules

\x3CHARD-GATE> Before executing install:

  1. Slug required: If the user wants to install an agentar but has not specified which one (no slug), prompt the user to enter the agentar name/slug to install. Do NOT run install without a slug.
  2. Mode confirmation (CRITICAL - MUST ASK USER): You MUST explicitly ask the user to choose the installation mode. Do NOT proceed with installation until the user has made a clear choice. NEVER assume or default to any mode without user confirmation.

Present the following two options to the user and wait for their response:

  1. new — Create a new agent. The existing agents are not affected.
  2. overwrite — Overwrite the main agent (~/.openclaw/workspace). The existing workspace will be backed up automatically.

Important:

  • Do NOT execute install until the user explicitly selects one of the above options
  • Do NOT use "new" as a default without asking
  • Do NOT use "overwrite" unless the user explicitly selects it
  • If the user chooses "new" but doesn't specify a name, use the slug as the default name

After the user explicitly selects "new", execute: $CLI install \x3Cslug> --name \x3Cuser-specified name> (add --version \x3Cver> if the user specified a version) After the user explicitly selects "overwrite", execute: $CLI install \x3Cslug> --overwrite (add --version \x3Cver> if the user specified a version)

Never execute install without both: (1) a slug, and (2) explicit user confirmation of installation mode. \x3C/HARD-GATE>

Export Rules

\x3CHARD-GATE> When the user has not specified which agent to export, you MUST let the user choose first. Do NOT export on your own. If --agent \x3Cid> was not provided by the user:

  1. Run $CLI export without --agent to list available agents (or equivalent to show choices).
  2. Present the list to the user and ask which agent to export.
  3. Only after the user explicitly selects an agent, run $CLI export --agent \x3Cuser-selected-id> (and optional -o, --include-memory as needed). Never assume or pick an agent for the user. \x3C/HARD-GATE>
  • MEMORY.md is excluded by default. Only include it if the user explicitly requests it with --include-memory.
  • Sensitive files are automatically filtered out during export (.credentials, .env, .secret, .key, .pem).
  • After a successful export, remind the user to review the exported ZIP for any sensitive data (API keys, credentials, personal information).
  • Export is a purely local operation — it does not require network access.

Error Handling

Error Action
CLI file not found Verify the skill is installed correctly — agentar_cli.mjs should be in the skill directory
API unreachable or network error Suggest checking network connectivity, or override the API URL with: export AGENTAR_API_BASE_URL=\x3Curl>
Node.js not installed Instruct user to install Node.js from https://nodejs.org/
Download or extraction failure Show the error message and suggest retrying the command

Workflow

  1. Search: Run $CLI search \x3Ckeyword> to find agentars. Each result includes a slug identifier.
  2. Install: If the user did not specify which agentar to install (no slug), ask the user to enter the agentar name/slug. Then confirm installation mode: present [1] new, [2] overwrite; never use overwrite without explicit user selection. Only after you have both slug and mode, execute the install command.
  3. Export: If the user did not specify which agent to export, run $CLI export (no --agent) to list agents, present the list to the user, and ask them to choose. Only after the user selects an agent, run $CLI export --agent \x3Cid>. Do not export without the user's explicit selection.
  4. Rollback: If the user wants to undo an overwrite install, run $CLI rollback to list available backups and restore one.
  5. Team Search: Run $CLI team search \x3Ckeyword> to find teams. Each result includes a slug identifier.
  6. Team Install: Confirm the slug with the user. Inform them that member agents will be installed or reused. Only after user confirmation, execute $CLI team install \x3Cslug>.
  7. Team List/Status: Run $CLI team list to see installed teams or $CLI team status \x3Cslug> for detailed member status.
Usage Guidance
This skill appears to do exactly what it claims: it provides a bundled Node CLI to manage agentars and teams and operates on the documented agent/workspace directories. Before using it: (1) follow the SKILL.md hard-gate and run the bundled CLI version check (node <skill-dir>/agentar_cli.mjs version) in a safe sandbox; (2) back up ~/.openclaw/workspace before any install that might use --overwrite; (3) avoid supplying an API key unless necessary — if you do, note it will be saved locally under the skill (skills/.credentials); (4) although the CLI claims GET-only network behavior, reviewers should inspect the full agentar_cli.mjs (or run it in an isolated environment) to be certain; and (5) if you have sensitive agent state, prefer exporting/backing up first rather than installing new agentars that overwrite the main workspace.
Capability Analysis
Type: OpenClaw Skill Name: catchclaw Version: 3.7.5 The 'catchclaw' skill is a comprehensive package manager for OpenClaw agents and teams, facilitating the search, installation, and export of agent archives. The bundled CLI (agentar_cli.mjs) demonstrates high-quality security practices, including thorough ZIP validation (protecting against path traversal, symlinks, and decompression bombs), sensitive file filtering (e.g., .env, .credentials) during exports, and restricted binary lookups to mitigate PATH hijacking. The SKILL.md instructions implement 'hard gates' that force the AI agent to obtain explicit user confirmation before performing high-risk actions like overwriting workspaces or installing multi-agent teams.
Capability Assessment
Purpose & Capability
Name/description (agentar manager) aligns with what is present: a bundled Node CLI (agentar_cli.mjs) and SKILL.md that document searching, installing, exporting agentars and teams. Required binaries (node) and documented config paths (~/.agentar, ~/.openclaw/...) are expected for this functionality.
Instruction Scope
SKILL.md restricts actions with hard-gates (verify bundled CLI version before any operation) and documents exact commands. It explicitly reads/writes agent/workspace and team directories and can overwrite the main workspace when --overwrite is chosen. The instructions also allow storing an API key to a local skills/.credentials file when --api-key is used. These behaviors are within the scope of an agentar manager but carry real risk to user data if used carelessly (workspace overwrite, locally-stored credentials).
Install Mechanism
No remote install/download step for the skill itself — it's instruction-only with a bundled CLI file. The bundled agentar_cli.mjs uses only Node built-ins (no external downloads required by the skill). This is low-risk compared with arbitrary remote downloads.
Credentials
No required environment secrets; two optional env vars (AGENTAR_API_BASE_URL, AGENTAR_HOME) are reasonable for overriding defaults. The documented optional storage of an --api-key in a local credentials file is justified for agentars that require backend auth but is a sensitive action and is clearly documented as optional.
Persistence & Privilege
Skill is not always-enabled, is user-invocable, and does not request elevated platform privileges. It reads/writes only its own and OpenClaw agent-related paths; it does not modify other skills' configuration. The main persistent risk is accidental workspace overwrite or saving API keys locally, both documented and gated by user prompts.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install catchclaw
  3. After installation, invoke the skill by name or use /catchclaw
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.7.5
Add install command selection gate to prevent agents from using install instead of team install for teams
v3.7.4
Restore top-level http/https imports for simplicity
v3.7.3
Lazy-load http/https modules inside network functions to decouple from config scope
v3.7.2
Add security annotations for static analysis scanner, fix env vars metadata from required to optional
v3.7.1
Remove unused install.sh and install.ps1 to resolve security scan findings
v3.7.0
Add version conflict detection for agentar/team install, team install --version support, member-level conflict confirmation
v3.6.8
fix: simplify subprocess module resolution
v3.6.7
fix: remove install scripts, restore builtinModules import
v3.6.6
fix: resolve security scan detection
v3.6.5
fix: resolve security scan detection for subprocess module import
v3.6.4
fix: resolve security scan false positive for subprocess module
v3.6.3
fix: use direct child_process import for transparency, remove obfuscated dynamic require
v3.6.2
fix: restore correct display name and indirect child_process resolution
v3.6.1
revert: restore indirect child_process resolution to pass ClawHub security scan
v3.6.0
Fix: replace obfuscated child_process resolution with direct import
v3.5.9
Rename display name to CatchClaw
v3.5.7
skill-v3.5.7 release
v3.5.6
fix suspicious issue
v3.5.5
fix windows bug
v3.5.4
fix security issue
Metadata
Slug catchclaw
Version 3.7.5
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 41
Frequently Asked Questions

What is CatchClaw?

Search, install, and export agentars and teams from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates or teams. It is an AI Agent Skill for Claude Code / OpenClaw, with 506 downloads so far.

How do I install CatchClaw?

Run "/install catchclaw" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is CatchClaw free?

Yes, CatchClaw is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does CatchClaw support?

CatchClaw is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created CatchClaw?

It is built and maintained by kissrain (@lovelcp); the current version is v3.7.5.

💬 Comments