SkillUp

SkillUp is a cross-platform skill publishing tool for packaging and syncing custom skills to GitHub, Xiaping Skill, OpenClaw CN, and ClawHub.

This skill appears to do what it says: packaging and publishing skills to the four listed platforms. Before using it: (1) review config.example.toml and fill only the tokens for platforms you want to publish to; (2) run with --dry-run to confirm behavior and artifact outputs; (3) be aware the scripts export tokens to invoke CLIs (GH_TOKEN, CLAWHUB_TOKEN, SKILLUP_OPENCLAW_TOKEN) and write logs to /tmp—treat these tokens as sensitive and rotate them if compromised; (4) note the openclaw helper temporarily sets NODE_TLS_REJECT_UNAUTHORIZED=0 for CLI calls (weakens TLS checks for that command), so prefer configuring a correct base_url/CA or avoid using the CLI against untrusted endpoints; (5) inspect and run the tool in a controlled environment (or container) if you don't fully trust the remote owner; and (6) use least-privilege tokens (scoped GitHub tokens) and test on a sample repo before wide use.

Type: OpenClaw Skill Name: skillup Version: 0.1.9 SkillUp is a legitimate developer utility designed to package and publish OpenClaw skills to various platforms including GitHub, Xiaping, and ClawHub. The bundle consists of shell scripts and Python snippets that automate versioning, packaging (via zip), and uploading (via curl/gh/claw CLIs). A notable security feature is implemented in `scripts/lib/common.sh` (`run_redact_check`), which proactively scans skill directories for sensitive information like private keys and API tokens to prevent accidental exfiltration during the publishing process. The tool's behavior is transparent and aligns entirely with its documented purpose.