← Back to Skills Marketplace
PhiProto CLI
by
chengongpp
· GitHub ↗
· v1.0.3
· MIT-0
89
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install phiproto
Description
Use when working with .phiproto files, PhiProto messages, or converting between .phiproto and CSV with the bundled phicli binary. Trigger on requests to insp...
Usage Guidance
This skill is coherent with its stated purpose but has two practical security concerns you should consider before installing or running it: 1) getphi.sh downloads an executable from a GitHub release and places it in ~/.local/bin without verifying a checksum or signature; 2) the script does not set the executable bit (chmod), so it may not be runnable as-is. If you want to use this skill safely: verify the GitHub repository and the release tag manually, prefer downloading a release with an accompanying hash/signature and verify it, run the binary in a sandbox or VM first, or ask the skill author to include a signed checksum or source code. If you cannot verify the binary, avoid executing it on sensitive systems.
Capability Assessment
Purpose & Capability
The skill claims to provide a 'bundled phicli binary' for working with .phiproto files and its instructions/auxiliary script do focus on decoding/encoding .phiproto as described. However the binary is not actually bundled in the package — instead getphi.sh downloads it from a GitHub release. This is a minor inconsistency but does not on its own make the skill unusable.
Instruction Scope
SKILL.md tells the agent to fetch phicli from github.com/chengongpp/phicli and then use it locally. The runtime instructions and helper script will download a remote executable into $HOME/.local/bin. The instructions do not request unrelated files/credentials, but they do direct network download and installation of an executable which expands the skill's scope beyond pure local file inspection. There is no integrity or signature check and the README claims the tool 'runs local-only' (a claim you cannot verify from this package).
Install Mechanism
There is no formal install spec in registry; instead the included getphi.sh uses wget to download a binary from a GitHub Releases URL (github.com/chengongpp/phiproto/releases/download/0.0.2/phicli) into $HOME/.local/bin. Downloading from GitHub releases is common, but the script does not verify checksums or signatures and does not set the executable bit (no chmod), which risks both usability and security. No archive extraction is done and the host is a known release host (GitHub), so risk is moderate but notable due to missing integrity checks.
Credentials
The skill does not request environment variables, credentials, or config paths. The only implicit use is $HOME as the target install location. There are no unrelated secrets or broad credential requests.
Persistence & Privilege
The skill writes a file into $HOME/.local/bin which is a per-user persistent location and may affect future PATH behavior. always:false (no forced inclusion) and the skill does not modify other skills or system-wide settings. Writing to the user's bin directory is expected for a user-scoped tool but is a persistent change the user should be aware of.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install phiproto - After installation, invoke the skill by name or use
/phiproto - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.3
- Updated safety notes to clarify that users must download the phicli binary from github.com/chengongpp/phicli, the only trusted source.
- No changes to commands or workflow; skill operation remains the same.
v1.0.2
- Updated safety notes to clarify that the tool is now local-only and does not fetch remote content.
- Removed instructions and examples related to PHI_ALLOWLIST and remote dependencies.
- Simplified response guidance to reflect the local-only operation.
- No changes to code or functionality; documentation only.
v1.0.0
Initial release of the phiproto skill.
- Supports decoding, encoding, and inspecting `.phiproto` files via the bundled `phicli` binary (Linux x86_64 only).
- Enables conversion between `.phiproto` and CSV formats.
- Responds to user requests to open, inspect, decode, encode, or explain `.phiproto` content.
- Provides command usage examples and safety recommendations, including allowlist instructions for remote content.
- Ensures repeatable workflows by recommending explicit output files.
Metadata
Frequently Asked Questions
What is PhiProto CLI?
Use when working with .phiproto files, PhiProto messages, or converting between .phiproto and CSV with the bundled phicli binary. Trigger on requests to insp... It is an AI Agent Skill for Claude Code / OpenClaw, with 89 downloads so far.
How do I install PhiProto CLI?
Run "/install phiproto" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is PhiProto CLI free?
Yes, PhiProto CLI is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does PhiProto CLI support?
PhiProto CLI is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created PhiProto CLI?
It is built and maintained by chengongpp (@chengongpp); the current version is v1.0.3.
More Skills