← Back to Skills Marketplace
315
Downloads
0
Stars
1
Active Installs
7
Versions
Install in OpenClaw
/install scan-to-skill
Description
QR-based skill installer for ClawHub. Decodes QR images (Telegram uploads, screenshots, camera captures), extracts a valid skill slug or install command, and...
Usage Guidance
This skill is internally coherent and enforces a safety gate (it defaults to dry run and requires --confirm). Before you install or use it: 1) ensure the host system has the 'clawhub' CLI installed and you trust installed ClawHub skills (installing any third-party skill can be risky); 2) verify the decoded slug/URL yourself before approving the install (open the skill page on ClawHub as suggested); 3) be aware the script may call 'zbarimg' or require opencv-python — ensure those binaries/packages are from trusted sources; and 4) confirm your agent will never pass the --confirm flag without explicit user consent. The only real issue to fix is metadata: the skill should declare that it relies on the 'clawhub' CLI and optionally 'zbarimg' or opencv so administrators know those dependencies exist.
Capability Analysis
Type: OpenClaw Skill
Name: scan-to-skill
Version: 0.2.2
The 'scan-to-skill' bundle is a utility for installing OpenClaw skills via QR code decoding. It features robust safety measures, including strict regex validation for skill slugs, a domain allowlist for URLs, and a mandatory human-in-the-loop confirmation step in SKILL.md before execution. The core script (scripts/install_from_qr.py) uses subprocess safely with argument lists and lacks any indicators of data exfiltration or malicious intent.
Capability Assessment
Purpose & Capability
The skill's name/description align with the code and SKILL.md: it decodes QR payloads, parses a ClawHub slug, and runs the ClawHub CLI to install. One minor inconsistency: registry metadata lists no required binaries, but the runtime uses the 'clawhub' CLI and optionally the 'zbarimg' binary (or the opencv Python package). Declaring those binaries in metadata would be appropriate.
Instruction Scope
SKILL.md instructs the agent only to detect an image, run the included script to decode/parse, prompt the user, and only install after explicit confirmation. The script itself enforces domain whitelisting and slug validation before executing an install command.
Install Mechanism
This is an instruction-only skill with a single helper script; there is no install spec that fetches external code or archives. The script runs locally and relies on existing system binaries or Python packages (opencv or zbarimg).
Credentials
The skill requests no environment variables or credentials. It does execute local commands (clawhub install) but only after parsing/validation and explicit confirmation. No secrets are requested or read by the script.
Persistence & Privilege
always is false and the skill does not attempt to modify other skills or system-wide config. The agent can invoke it autonomously (default), but SKILL.md requires an explicit user approval step before installing, which limits autonomous privilege escalation.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install scan-to-skill - After installation, invoke the skill by name or use
/scan-to-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.2
Agent now proactively prompts user to install after showing decoded results, keeping --confirm safety gate while ensuring smooth UX
v0.2.1
Script now defaults to dry run. Install only executes with explicit --confirm flag, removing reliance on agent-level compliance for safety.
v0.2.0
Security fix: add ClawHub domain allowlist for URLs, reject non-ClawHub domains, remove auto-install (require user confirmation), add trusted/untrusted source tracking
v0.1.3
Improve description for QR auto-install flow
v0.1.2
Add Telegram image auto-trigger install flow
v0.1.1
README upgrade with quickstart and safety notes
v0.1.0
Initial release: QR scan to auto install
Metadata
Frequently Asked Questions
What is Scan To Skill?
QR-based skill installer for ClawHub. Decodes QR images (Telegram uploads, screenshots, camera captures), extracts a valid skill slug or install command, and... It is an AI Agent Skill for Claude Code / OpenClaw, with 315 downloads so far.
How do I install Scan To Skill?
Run "/install scan-to-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Scan To Skill free?
Yes, Scan To Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Scan To Skill support?
Scan To Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Scan To Skill?
It is built and maintained by Jack Lee (@jackleeio); the current version is v0.2.2.
More Skills