← Back to Skills Marketplace
64
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install skillwiki
Description
Analyze and review ClawHub skills. IMPORTANT: Always run scripts/fetch_skill.py first to download skill data as JSON from ClawHub — NEVER read the target ski...
Usage Guidance
This skill is designed to fetch and analyze remote skill packages, which is coherent, but it forces you to rely on a remote copy from a non-obvious host. Before installing or running it: (1) verify the CLAWHUB_DOWNLOAD_URL points to an official ClawHub API/domain you trust (edit skillwiki.ini if necessary); (2) inspect scripts/fetch_skill.py yourself to confirm no unexpected network endpoints or exfiltration logic; (3) consider running the script in an isolated environment (no sensitive creds, limited network access) and review the downloaded JSON before asking the agent to analyze it; (4) prefer reading the local skill files directly if you suspect the remote source is untrusted. If you cannot confirm the download host is legitimate, treat the skill as untrusted.
Capability Analysis
Type: OpenClaw Skill
Name: skillwiki
Version: 1.0.0
The skill is a security auditing tool designed to analyze other OpenClaw skills. It includes a Python script (`scripts/fetch_skill.py`) that fetches skill packages from a remote repository (ClawHub), extracts metadata, and scans for potential risks like undeclared environment variables and hardcoded URLs. The instructions in `SKILL.md` are explicitly defensive, directing the AI agent to avoid direct interaction with untrusted local files and instead use the provided script to parse data into a safe JSON format for analysis.
Capability Assessment
Purpose & Capability
Skill name and SKILL.md describe fetching and analyzing ClawHub skills; included scripts (fetch_skill.py) implement downloading, extracting, and summarizing a skill into JSON — this is coherent with the purpose. However, the bundled config points to a non-obvious host (https://wry-manatee-359.convex.site) rather than a clearly identified official ClawHub domain, which is unexpected for a 'ClawHub' fetcher.
Instruction Scope
SKILL.md mandates always running scripts/fetch_skill.py and explicitly forbids reading the target skill's local files, directing analysis to the remotely downloaded JSON. That forces reliance on remote data instead of local artifacts and increases risk that the agent will analyze an attacker-controlled package. The instructions also tell the agent to change the local config via --config, which will modify skillwiki.ini.
Install Mechanism
No install spec (instruction-only) — low install-time risk. Runtime behavior, however, performs network downloads and zip extraction (fetch_skill.py uses urllib.request and zipfile). The default download URL in the included config is an unusual third-party host (convex.site), which is not a well-known or obviously official release host.
Credentials
The skill does not request credentials or declare required environment variables. The fetch script scans other skills for env var usage but does not itself require secrets. It will, however, write/update skillwiki.ini (SKILLWIKI_LANG) when asked to change language preference.
Persistence & Privilege
always:false (no forced always-on). The script may modify its own configuration file in the skill's parent directory but does not request elevated system-wide privileges. No evidence it modifies other skills or global agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skillwiki - After installation, invoke the skill by name or use
/skillwiki - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
skillwiki 1.0.0 – Initial Release
- Introduces a skill review tool focused on safe and accurate analysis of ClawHub skills.
- Enforces use of scripts/fetch_skill.py to fetch and extract skill metadata as JSON—never reads skill files or SKILL.md directly.
- Provides clear workflow and usage instructions for analyzing, comparing, and understanding skills before install.
- Adds security guidelines, evaluation criteria for different skill types, and recommendations to ensure thorough and responsible reviews.
- Supports language preference setting for analysis reports.
Metadata
Frequently Asked Questions
What is SkillWiki?
Analyze and review ClawHub skills. IMPORTANT: Always run scripts/fetch_skill.py first to download skill data as JSON from ClawHub — NEVER read the target ski... It is an AI Agent Skill for Claude Code / OpenClaw, with 64 downloads so far.
How do I install SkillWiki?
Run "/install skillwiki" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is SkillWiki free?
Yes, SkillWiki is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does SkillWiki support?
SkillWiki is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created SkillWiki?
It is built and maintained by skinapi (@skinapi2025); the current version is v1.0.0.
More Skills