← Back to Skills Marketplace
myskill
by
pipsqueakup
· GitHub ↗
· v1.0.0
· MIT-0
240
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install new-slug
Description
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express...
Usage Guidance
This skill's visible instructions are harmless (searching with 'npx skills'), but the included Python script deviates from the manifest in ways that could have side effects. Before installing or letting an agent run this skill: 1) Ask the publisher why the Python script is included and why it needs DASHSCOPE_API_KEY (not advertised). 2) Review or run the Python file only in a sandbox to see what it does (it creates sample_skill/ and calls Toolkit.register_agent_skill). 3) Avoid allowing automated/global installs with '-g -y' without explicit user confirmation. 4) If you don't intend to run the Python script, consider removing or isolating it; if you do need its functionality, require the manifest be updated to declare the DASHSCOPE_API_KEY dependency and any filesystem/config changes. If the publisher can't explain the mismatch, treat the package as untrusted.
Capability Analysis
Type: OpenClaw Skill
Name: he1f
Version: 1.0.0
The skill bundle provides the agent with the capability to search for and install third-party software using the 'npx skills add' command with the '-y' flag, which bypasses user confirmation (SKILL.md). While this aligns with the stated purpose of a skill manager, it grants the agent high-privilege control over the system's environment and software supply chain. The included Python script (task_agent_skill.py) is a benign tutorial for the AgentScope framework, though it demonstrates the use of sensitive environment variables like DASHSCOPE_API_KEY.
Capability Assessment
Purpose & Capability
SKILL.md describes a lightweight 'find and install skills' helper that uses the Skills CLI (npx skills). However, the package also contains a Python script that creates a local 'sample_skill' directory, registers that skill via an agentscope Toolkit, and constructs a DashScopeChatModel that reads os.environ['DASHSCOPE_API_KEY']. The script's dependencies and environment access (DashScope API key, agentscope) are not reflected in the skill metadata and are not necessary for the described find/install functionality.
Instruction Scope
The runtime instructions (SKILL.md) are limited to guiding an agent to use 'npx skills find' and 'npx skills add'. Those instructions are coherent. However, SKILL.md does not mention the included Python script at all. The instructions also recommend 'npx skills add ... -g -y' which installs globally and skips confirmations — a potentially risky operation if performed without explicit user consent.
Install Mechanism
There is no install spec (instruction-only), which is low risk. But the repository includes an executable Python file that, if run, will write files to the current working directory (creates sample_skill/SKILL.md) and calls Toolkit.register_agent_skill. The package does not declare this behavior, so the presence of code capable of filesystem writes is an unexpected surface area.
Credentials
Manifest declares no required environment variables, yet the Python script directly references os.environ['DASHSCOPE_API_KEY'] (required at runtime). This is a clear mismatch: the skill asks for an API key it never declared and which is unrelated to the stated purpose of searching/installing skills.
Persistence & Privilege
Skill flags are default (no 'always' privilege). The Python script registers a skill via Toolkit.register_agent_skill and writes a sample skill directory, which may modify agent skill registrations or leave files on disk if executed. The metadata does not disclose any config path modifications; this discrepancy is noteworthy but not on its own proof of malicious intent.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install new-slug - After installation, invoke the skill by name or use
/new-slug - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of the test skill.
- No file changes detected in this version.
Metadata
Frequently Asked Questions
What is myskill?
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... It is an AI Agent Skill for Claude Code / OpenClaw, with 240 downloads so far.
How do I install myskill?
Run "/install new-slug" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is myskill free?
Yes, myskill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does myskill support?
myskill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created myskill?
It is built and maintained by pipsqueakup (@pipsqueakup); the current version is v1.0.0.
More Skills