← Back to Skills Marketplace
lovelcp

Catchclaw Agentar

by kissrain · GitHub ↗ · v3.5.7 · MIT-0
cross-platform ⚠ suspicious
411
Downloads
0
Stars
0
Active Installs
24
Versions
Install in OpenClaw
/install catch-claw
Description
Search, install, and export agentars from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates.
README (SKILL.md)

CatchClaw Agentar Manager

Source: This skill is from the CatchClaw skill repository.

An agentar is a distributable agent archive (ZIP) containing workspace files such as SOUL.md, skills, and other configuration. It can be installed as a new agent or used to overwrite an existing agent with a single command.

Trigger Conditions

  • User asks to search / find / browse agentars
  • User asks to install / download a specific agentar
  • User asks to export / package an agent as an agentar
  • User asks to rollback / undo / restore a previous agent workspace
  • User mentions the keyword "agentar" or "catchclaw"

Important: Before performing any action, verify the bundled CLI works (see CLI Setup). Do not run search, install, export, or rollback until verification passes.

CLI Setup (mandatory — run before any command)

\x3CHARD-GATE> Before running any search, install, export, or rollback command, you MUST verify the bundled CLI. The CLI (agentar_cli.mjs) is bundled in this skill's directory — no download or copy is needed.

  1. Locate: The CLI is at the same directory as this SKILL.md (e.g. ~/.agents/skills/catchclaw/agentar_cli.mjs).
  2. Verify: Run node \x3Cskill-dir>/agentar_cli.mjs version. Only after it succeeds, proceed with search/install/export/rollback.

Never run $CLI search, $CLI install, $CLI export, or $CLI rollback until verification passes. \x3C/HARD-GATE>

CLI Location

The CLI is bundled in this skill's directory. Run it directly:

node \x3Cskill-dir>/agentar_cli.mjs \x3Ccommand>

Where \x3Cskill-dir> is the directory containing this SKILL.md (e.g. ~/.agents/skills/catchclaw/).

All commands below use $CLI as shorthand for node \x3Cskill-dir>/agentar_cli.mjs.

Environment Variables (optional)

These are listed in metadata.openclaw.requires.env for registry/security analysis. Neither is required for normal use; omit both to use defaults.

  • AGENTAR_API_BASE_URL — Override the default API base URL (defaults to https://catchclaw.me)
  • AGENTAR_HOME — Override the default CLI config directory (defaults to ~/.agentar)

Paths read or written by the bundled CLI

Aligned with metadata.openclaw.requires.config and metadata.json in this skill:

Path Access Purpose
~/.agentar/ read/write CLI config (config.json), optional standalone install copy of agentar_cli.mjs
~/.openclaw/workspace read/write Main agent workspace (install --overwrite, export)
~/.openclaw/agentar-workspaces/ read/write Per-agent workspaces (install --name …)
~/agentar-exports/ write Default directory for export ZIP output
\x3Cskill-dir>/skills/.credentials write (optional) Written when install is run with --api-key

Commands

Search

$CLI search \x3Ckeyword>

Search the CatchClaw marketplace for agentars matching the keyword.

Install

$CLI install \x3Cslug> --name \x3Cname> [--api-key \x3Ckey>]
$CLI install \x3Cslug> --overwrite

Install an agentar from the marketplace.

Options:

  • --name \x3Cname> — Create a new agent with the given name. Existing agents are not affected. (Preferred; list this option first when prompting.)
  • --overwrite — Overwrite the main agent (~/.openclaw/workspace). Existing workspace is backed up automatically. Never use without the user's explicit selection.
  • --api-key \x3Ckey> — (Optional) API key to save into skills/.credentials for agentars that require backend authentication.

Export

$CLI export [--agent \x3Cid>] [-o \x3Cpath>] [--include-memory]

Export an agent as a distributable agentar ZIP package. MEMORY.md is excluded by default. Output defaults to ~/agentar-exports/. Sensitive files (.credentials, .env, .secret, .key, .pem) are automatically filtered out.

Options:

  • --agent \x3Cid> — Agent ID to export. If the user did not specify an agent, you MUST list agents and ask the user to choose before running export; do not export without the user's selection.
  • -o, --output \x3Cpath> — Output ZIP file path.
  • --include-memory — Include MEMORY.md in export (excluded by default).

Rollback

$CLI rollback
$CLI rollback --latest

Restore a workspace from backup. Without --latest, lists all available backups for selection. The current workspace is automatically backed up before restoring, so rollback is always safe.

Version

$CLI version

Show the CLI version.

Installation Rules

\x3CHARD-GATE> Before executing install:

  1. Slug required: If the user wants to install an agentar but has not specified which one (no slug), prompt the user to enter the agentar name/slug to install. Do NOT run install without a slug.
  2. Mode confirmation (CRITICAL - MUST ASK USER): You MUST explicitly ask the user to choose the installation mode. Do NOT proceed with installation until the user has made a clear choice. NEVER assume or default to any mode without user confirmation.

Present the following two options to the user and wait for their response:

  1. new — Create a new agent. The existing agents are not affected.
  2. overwrite — Overwrite the main agent (~/.openclaw/workspace). The existing workspace will be backed up automatically.

Important:

  • Do NOT execute install until the user explicitly selects one of the above options
  • Do NOT use "new" as a default without asking
  • Do NOT use "overwrite" unless the user explicitly selects it
  • If the user chooses "new" but doesn't specify a name, use the slug as the default name

After the user explicitly selects "new", execute: $CLI install \x3Cslug> --name \x3Cuser-specified name> After the user explicitly selects "overwrite", execute: $CLI install \x3Cslug> --overwrite

Never execute install without both: (1) a slug, and (2) explicit user confirmation of installation mode. \x3C/HARD-GATE>

Export Rules

\x3CHARD-GATE> When the user has not specified which agent to export, you MUST let the user choose first. Do NOT export on your own. If --agent \x3Cid> was not provided by the user:

  1. Run $CLI export without --agent to list available agents (or equivalent to show choices).
  2. Present the list to the user and ask which agent to export.
  3. Only after the user explicitly selects an agent, run $CLI export --agent \x3Cuser-selected-id> (and optional -o, --include-memory as needed). Never assume or pick an agent for the user. \x3C/HARD-GATE>
  • MEMORY.md is excluded by default. Only include it if the user explicitly requests it with --include-memory.
  • Sensitive files are automatically filtered out during export (.credentials, .env, .secret, .key, .pem).
  • After a successful export, remind the user to review the exported ZIP for any sensitive data (API keys, credentials, personal information).
  • Export is a purely local operation — it does not require network access.

Error Handling

Error Action
CLI file not found Verify the skill is installed correctly — agentar_cli.mjs should be in the skill directory
API unreachable or network error Suggest checking network connectivity, or override the API URL with: export AGENTAR_API_BASE_URL=\x3Curl>
Node.js not installed Instruct user to install Node.js from https://nodejs.org/
Download or extraction failure Show the error message and suggest retrying the command

Workflow

  1. Search: Run $CLI search \x3Ckeyword> to find agentars. Each result includes a slug identifier.
  2. Install: If the user did not specify which agentar to install (no slug), ask the user to enter the agentar name/slug. Then confirm installation mode: present [1] new, [2] overwrite; never use overwrite without explicit user selection. Only after you have both slug and mode, execute the install command.
  3. Export: If the user did not specify which agent to export, run $CLI export (no --agent) to list agents, present the list to the user, and ask them to choose. Only after the user selects an agent, run $CLI export --agent \x3Cid>. Do not export without the user's explicit selection.
  4. Rollback: If the user wants to undo an overwrite install, run $CLI rollback to list available backups and restore one.
Usage Guidance
This skill appears to do what it claims: it runs a bundled Node CLI to talk to a CatchClaw marketplace, download agentar ZIPs, and read/write OpenClaw workspaces. Before using it: 1) Verify the CLI locally as SKILL.md requires (run `node <skill-dir>/agentar_cli.mjs version`) and inspect the code if you have concerns. 2) Note that registry metadata says two env vars are required but the SKILL.md says they are optional — you can omit them to use defaults; set AGENTAR_API_BASE_URL only if you need a custom server. 3) When installing, be explicit about install mode (new vs overwrite) and avoid passing API keys unless you trust the agentar; supplied keys are saved to a local skills/.credentials file. 4) If you need higher assurance, review the full agentar_cli.mjs (it uses only Node builtins but includes a slightly unusual dynamic lookup of child_process, which appears functional rather than malicious).
Capability Analysis
Type: OpenClaw Skill Name: catch-claw Version: 3.5.7 The skill provides agent management functionality (search, install, export) but contains obfuscated code in `agentar_cli.mjs` to resolve the `child_process` module (using `builtinModules.find` with character matching), a common technique for evading static analysis. While the script includes security-conscious logic—such as explicitly filtering sensitive files (.env, .key, .credentials) during exports and creating backups before overwriting workspaces—the intentional hiding of process execution capabilities is a significant red flag. The CLI also performs 'metadata enrichment' by programmatically prompting the agent via the `openclaw` binary, which creates a complex self-invocation loop.
Capability Assessment
Purpose & Capability
Name/description, the bundled Node CLI, and the declared config paths (~/.agentar, ~/.openclaw/workspace, agentar-exports) all align with a tool that finds, installs, and packages agent archives. Requiring the node binary is expected.
Instruction Scope
SKILL.md instructs the agent to verify and then run the bundled CLI to search/install/export/rollback; all referenced files and operations (backup, overwrite, export filtering of sensitive files) are within the skill's stated domain. One procedural inconsistency: the registry marks AGENTAR_API_BASE_URL and AGENTAR_HOME as required env vars, but SKILL.md explicitly says both are optional and defaults exist.
Install Mechanism
There is no external install step; the CLI is bundled in the skill and uses only Node builtins. The CLI performs HTTP requests and may download agentar ZIPs from the marketplace URL (default https://catchclaw.me), which is expected behavior for this purpose.
Credentials
Only two env vars are referenced (API base URL and CLI home), and they are optional per SKILL.md — this is proportional. The skill will read/write the listed OpenClaw workspace paths and may write a local skills/.credentials file if the user supplies an --api-key. The registry's 'required env vars' claim is misleading.
Persistence & Privilege
The skill does not request always:true, and autonomous invocation is default but not excessive here. It persists data only to its own CLI home (~/.agentar), backups, and OpenClaw workspace locations it manages as part of install/export/rollback, which is consistent with its functionality.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install catch-claw
  3. After installation, invoke the skill by name or use /catch-claw
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.5.7
skill-v3.5.7 release
v3.5.6
fix suspicious issue
v3.5.5
fix windows bug
v3.5.4
fix security issue
v3.5.3
- fix(skill): restore dynamic child_process loading to pass marketplace scanner;
v3.5.2
- fix(skill): use direct child_process import and restrict binary search paths;
v3.5.1
- fix(skill): avoid static-analysis false positive for subprocess import;
v3.5.0
add more features
v3.4.1
- fix: zip compatibility - CP437 filename decoding and Windows path sep;
v3.4.0
- fix: rewrite extractZip to use central directory for accurate sizes;
v3.3.9
skill-v3.3.9 release
v3.3.8
- fix: declare env vars and run CLI from skill dir directly;
v3.3.7
- fix: remove static child_process import to pass security scan;
v3.3.6
- fix: replace spawnSync with fs lookup in findOpenclawBin;
v3.3.5
- fix: preserve skill metadata fields during release build;- fix(catchclaw): 更新CLI设置流程并添加新文件;
v3.3.3
fix security issues
v3.3.1
- fix: reset metadata.json version to match tarball (3.3.0);- fix: remove agentar_cli.mjs references from release-skill.sh;- chore(cli): 更新版本号并添加强制重装选项;- chore(cli): 更新版本号并添加强制重装选项;- refactor(install.ps1): 统一路径拼接方式;- docs(agentar/SKILL.md): 更新技能文档;- fix(cli): 改进错误处理并启用shell模式;- fix(SKILL.md): 更新技能名称为agentar;- chore(cli): 更新版本号并修正安装指令格式;- fix(AgentarManagerImpl): 修改获取包指令返回值中的表述错误;
v3.2.0
Security fix: replace execSync with spawnSync to prevent shell injection, add input validation for slugs and paths, remove OS metadata from exports.
v3.1.0
Initial release of CatchClaw skill for clawhub. Self-contained agentar CLI for searching, installing, and exporting agent templates. Cross-platform support (macOS, Linux, Windows).
v1.1.5
v1.1.5 release
Metadata
Slug catch-claw
Version 3.5.7
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 24
Frequently Asked Questions

What is Catchclaw Agentar?

Search, install, and export agentars from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates. It is an AI Agent Skill for Claude Code / OpenClaw, with 411 downloads so far.

How do I install Catchclaw Agentar?

Run "/install catch-claw" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Catchclaw Agentar free?

Yes, Catchclaw Agentar is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Catchclaw Agentar support?

Catchclaw Agentar is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Catchclaw Agentar?

It is built and maintained by kissrain (@lovelcp); the current version is v3.5.7.

💬 Comments