← Back to Skills Marketplace
189
Downloads
0
Stars
0
Active Installs
8
Versions
Install in OpenClaw
/install sherpamind
Description
Use for SherpaDesk-related requests: ticket lookup, support-history retrieval, account/user/technician analysis, stale-ticket review, workload questions, ope...
Usage Guidance
This repository appears internally consistent with its SherpaDesk-backend purpose, but before installing or enabling live sync:
- Review scripts/bootstrap.py and scripts/run.py (and the systemd unit content produced by install-service) so you know exactly what will run and when.
- Keep the workspace (the directory containing .SherpaMind/) somewhere private and outside any git-tracked repo; do not commit .SherpaMind/ or its secrets. Confirm .gitignore excludes .SherpaMind/.
- The staged API key is stored in plaintext under .SherpaMind/private/secrets/sherpadesk_api_key.txt — use a least-privilege API token and be prepared to rotate it if it is ever exposed.
- The tool will create a local SQLite DB and may generate public Markdown artifacts under .SherpaMind/public/; do not serve those files or move them to a public location if they contain sensitive derived data.
- The bootstrap process will pip-install dependencies from PyPI; run bootstrap-audit first and consider doing the initial run in an isolated environment or VM if you want to inspect behavior safely.
- If you plan to enable the optional user-level systemd service, inspect the generated unit and logs and only enable it when comfortable with ongoing background network calls to SherpaDesk.
If you want extra assurance, run the bootstrap and initial seed in a disposable environment, confirm the files written and requests made, then proceed to use in production with the mitigations above.
Capability Analysis
Type: OpenClaw Skill
Name: sherpamind
Version: 0.1.7
SherpaMind is a legitimate and well-documented local integration for SherpaDesk. It implements a comprehensive system for data ingestion, SQLite storage, and background synchronization. The skill follows security best practices for local secret management, storing API keys in a private directory with restricted file permissions (0o600). It includes a systemd user-level service for background tasks, which is explicitly documented as part of its operational model. No evidence of data exfiltration, malicious code execution, or prompt injection was found; all network activity is directed to the official SherpaDesk API (api.sherpadesk.com).
Capability Assessment
Purpose & Capability
Name/description match the included code and runtime guidance: this is a local SherpaDesk ingest/sync/enrichment backend plus a skill-front for queries. The primary credential (SHERPADESK_API_KEY) and required interpreter (python3/python) are appropriate and expected for the stated functionality. There are no unrelated credentials or unexplained external services requested.
Instruction Scope
SKILL.md instructs the agent/operator to run the repo-local Python runner and describes creating workspace-local state under .SherpaMind/ (DB, venv, config, secrets, public artifacts) and optionally installing a user-level systemd service. Those actions are consistent with a local backend but do involve writing plaintext staged API keys and generating public artifact files — the operator must ensure the workspace location is appropriate and not accidentally committed or publicly served.
Install Mechanism
There is no formal install spec in the registry, but the repo includes bootstrap and run scripts that create a venv and install Python dependencies from PyPI (httpx, pydantic, tenacity, typer, rich). That is a common pattern for Python projects; it entails network downloads from PyPI and writing runtime files to disk. Inspect scripts/bootstrap.py and scripts/run.py before running and prefer running bootstrap-audit first.
Credentials
Only the SherpaDesk API key is declared as the primary credential, which is proportional to the stated purpose. However, the skill stages that key into a plaintext file under .SherpaMind/private/secrets/sherpadesk_api_key.txt by design — this is convenient but increases exposure risk if the workspace is misconfigured, backed up, or committed. The skill otherwise does not request unrelated credentials.
Persistence & Privilege
Persistent, user-scoped behavior is explicit and expected: a workspace-local SQLite DB, generated public artifacts, and an optional user-level systemd service. always:false and normal autonomous invocation mean it doesn't force inclusion in every agent run, but installing and enabling the background service gives it ongoing execution capability on the host (user-level only). Operators should review the service unit and confirm they want continuous local sync before enabling it.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install sherpamind - After installation, invoke the skill by name or use
/sherpamind - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.7
Improve retrieval chunk balancing, retrieval observability, health artifacts, and cold enrichment signal handling.
v0.1.6
Restore the top-level private/public runtime boundary while keeping staged internal organization and updated metadata.
v0.1.5
Add OpenClaw manifest metadata for homepage, binary requirements, and primary credential env mapping.
v0.1.4
Adopt audit-first staged-secret onboarding, split workspace runtime layout, explicit daemon-later flow, and repaired live migration/runtime wiring.
v0.1.3
Clarify required SherpaDesk credentials, local runtime writes, PyPI bootstrap behavior, and optional user-level background service behavior in public-facing skill docs.
v0.1.2
Add adaptive cold-bootstrap budgeting, first-full-pass tracking, slower post-bootstrap maintenance, refreshed docs, and runtime observability.
v0.1.1
Harden workspace install/publish path, externalize runtime under .SherpaMind, and fix service-run-once JSON serialization.
v0.1.0
Readiness audit
Metadata
Frequently Asked Questions
What is SherpaMind?
Use for SherpaDesk-related requests: ticket lookup, support-history retrieval, account/user/technician analysis, stale-ticket review, workload questions, ope... It is an AI Agent Skill for Claude Code / OpenClaw, with 189 downloads so far.
How do I install SherpaMind?
Run "/install sherpamind" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is SherpaMind free?
Yes, SherpaMind is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does SherpaMind support?
SherpaMind is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created SherpaMind?
It is built and maintained by kklouzal (@kklouzal); the current version is v0.1.7.
More Skills