← Back to Skills Marketplace
SkillForge
by
shadoprizm
· GitHub ↗
· v1.0.4
· MIT-0
94
Downloads
0
Stars
0
Active Installs
5
Versions
Install in OpenClaw
/install skillforge-cli
Description
Generate and audit OpenClaw agent skills from natural language. Use when the operator asks to create a skill, build a skill, generate a skill, audit a skill,...
Usage Guidance
Before installing or running this skill, verify the upstream npm package and GitHub repository (https://github.com/shadoprizm/skillforge) yourself: inspect the package source, release history, and maintainer. Do not run --pro or audit commands against directories containing secrets, private keys, or production API keys — the tool will send skill contents to whichever AI provider you configure. Consider using an ephemeral/test API key for Pro mode, and confirm how keys are stored (the SKILL.md/skill.json indicate keys are saved under ~/.skillforge via 'conf', which may be plaintext). Also note the registry metadata omission: SKILL.md expects npm and clawhub CLI presence even though 'Required binaries' is empty; ensure you have and trust those tools before proceeding.
Capability Analysis
Type: OpenClaw Skill
Name: skillforge-cli
Version: 1.0.4
The skill serves as a wrapper for the `@shadoprizm/skillforge` CLI, which requires global npm installation and the management of several sensitive AI API keys (OpenAI, OpenRouter, etc.). It performs high-risk operations such as reading local file contents to send to external AI providers for auditing and publishing skills to the ClawHub registry (skill.json, SKILL.md). While these capabilities are aligned with its stated purpose as a developer utility and include safety warnings, the combination of broad file system access, network transmission of local data, and global package dependencies represents a significant security surface.
Capability Assessment
Purpose & Capability
The name/description (generate & audit skills) align with the instructions in SKILL.md. However, SKILL.md expects npm and the ClawHub CLI (clawhub login/publish) to be available, while the registry metadata says 'Required binaries: none'—this is an inconsistency. skill.json points to a GitHub repo as the source, but the registry-level 'Homepage: none' contradicts that.
Instruction Scope
The runtime instructions stay within the stated purpose: run the SkillForge CLI to generate/audit skill directories and (when --pro is used) send skill contents to the user-selected AI provider. The SKILL.md explicitly warns not to audit directories containing secrets. It does not instruct the agent to read unrelated files, hidden system paths, or undisclosed environment variables.
Install Mechanism
The skill is instruction-only (no install spec), but SKILL.md instructs users to run npm install -g @shadoprizm/skillforge. Installing a third-party global npm package runs arbitrary code on the host — this is expected for a CLI but increases risk and should be validated by inspecting the package and its GitHub source. No direct install URL or extract-from-unknown-host behavior is present, which is good, but the absence of an install spec in registry metadata plus contradictory homepage information is a minor red flag.
Credentials
No required env vars are declared at the registry level, and the skill.json sensibly lists several optional API keys (ZAI_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, QWEN_API_KEY) needed only for Pro features — this is proportionate. However, skill.json states keys are stored locally under ~/.skillforge using the 'conf' package and describes storage inconsistently (calls it both encrypted and plaintext-like). Storing API keys locally in cleartext (or in a location with bash-like permissions) is sensitive and should be considered before use.
Persistence & Privilege
The skill does not request always:true, does not declare system config path access, and does not attempt to modify other skills. It uses normal autonomous invocation defaults. No elevated persistence or cross-skill config changes are requested.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skillforge-cli - After installation, invoke the skill by name or use
/skillforge-cli - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.4
Fix: corrected conf storage claim (plaintext, not encrypted). Added content-sending warning for Pro mode audits.
v1.0.3
Full transparency: MIT license, GitHub source, npm package, dependency list, exact API endpoints, encrypted key storage details
v1.0.2
Full metadata transparency: install steps, env vars, network calls, credential handling, source repo
v1.0.1
Added skill.json metadata
v1.0.0
Initial release: skill generator and auditor for OpenClaw
Metadata
Frequently Asked Questions
What is SkillForge?
Generate and audit OpenClaw agent skills from natural language. Use when the operator asks to create a skill, build a skill, generate a skill, audit a skill,... It is an AI Agent Skill for Claude Code / OpenClaw, with 94 downloads so far.
How do I install SkillForge?
Run "/install skillforge-cli" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is SkillForge free?
Yes, SkillForge is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does SkillForge support?
SkillForge is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created SkillForge?
It is built and maintained by shadoprizm (@shadoprizm); the current version is v1.0.4.
More Skills