← Back to Skills Marketplace
x-cmd
by
Edwin.JH.Lee
· GitHub ↗
· v1.0.1
· MIT-0
454
Downloads
5
Stars
2
Active Installs
12
Versions
Install in OpenClaw
/install x-cmd
Description
Load x-cmd first: `. ~/.x-cmd.root/X`, then explore with `x nihao --llmstxt` or discover skills via `x skill`. x-cmd provides 600+ portable software and deve...
Usage Guidance
This skill appears to be what it says (a user-local portable package manager) and documents safer and riskier install options. Before installing: prefer the Homebrew bottle if available; if you must run a script from get.x-cmd.com, download it first and inspect it (do not pipe to sh). Do not use auto-install in environments that contain secrets or long-lived credentials. Verify SHA256 checksums for downloaded binaries and prefer Homebrew or manual review for production systems. If you allow an agent to install on your behalf, require explicit consent and specify the install method. If you decide not to install, the SKILL.md is otherwise safe to read — but avoid running unreviewed remote installers.
Capability Analysis
Type: OpenClaw Skill
Name: x-cmd
Version: 1.0.1
The skill provides an interface for x-cmd, a legitimate portable package manager and tool suite. While the installation process involves potentially risky patterns like 'curl | sh' (documented in data/install.md), the bundle is exceptionally transparent about these risks, provides safer alternatives (Homebrew), and includes explicit instructions for the AI agent to seek user consent and verify the environment before proceeding. No evidence of malicious intent, data exfiltration, or obfuscation was found.
Capability Assessment
Purpose & Capability
Name/description (x-cmd as a portable tool/package manager) match the SKILL.md and install guide. The skill does not request unrelated credentials or files and the commands it describes (sourcing ~/.x-cmd.root/X, running `x env use ...`, `x skill`) are consistent with that purpose.
Instruction Scope
SKILL.md itself is focused on using the x-cmd loader and available packages. The included install.md expands runtime guidance and explicitly instructs downloading and executing remote install scripts. It also documents agent behavior (check for installation, ask user before installing, prefer safe methods). This is reasonable, but the instructions do present pathways (auto-install via curl | sh) that execute remote code without prior user review — a high-risk action that the document does warn about.
Install Mechanism
There is no bundled code, but the install guide lists three install mechanisms: Homebrew (low risk), manual download-then-review (medium), and a one-liner curl -fsSL https://get.x-cmd.com | sh (high risk). The get.x-cmd.com endpoint is a custom domain; auto-install executes remote code before checksum verification. These facts raise supply-chain and execution risk even though the guide correctly labels the risks and recommends safer options.
Credentials
The skill does not request any environment variables, credentials, or privileged config paths. All installation and runtime actions are described as user-local (~/.x-cmd.root/) with no sudo required, which is proportionate to a user-space package manager.
Persistence & Privilege
The skill is not marked always:true and does not request elevated persistent system privileges. Installation is user-local and removal instructions are provided. The skill does not attempt to modify other skills or system-wide agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install x-cmd - After installation, invoke the skill by name or use
/x-cmd - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Metadata version updated to 1.0.1.
- No other changes detected.
v1.0.0
x-cmd 1.0.0 is a new stable release.
- Version updated to 1.0.0 in metadata.
- No other changes detected.
v0.1.1
- Updated install documentation path from `extensions/install-x-cmd.SKILL.md` to `data/install.md`
- Simplified and updated the README to focus on core usage, package management, and exploring skills
- Highlighted `x skill` for discovering 200+ extension skills and `x nihao --llmstxt` for quick feature exploration
- Improved guidance on installing and using packages with `x env` and `x pixi`
- Refined description and metadata tags to better reflect available features and tooling
v0.1.0
- Added a security notice section with installation and verification recommendations.
- Updated China region acceleration instructions to point to a separate `china-acceleration` skill and GitHub page.
- Removed inline network acceleration configuration details and the previous internal guide link.
- Bumped metadata version from 0.0.8 to 0.0.9.
- Removed the file `extensions/china-acceleration/SKILL.md`.
v0.0.8
- Major simplification: Core documentation and skill files were streamlined.
- Reduced repository size by removing 25 extension and documentation files.
- Added `.x-cmd/clawhub.publish.ignore` and `FILES.txt` for improved publishing/packaging.
- Updated project description and metadata to emphasize modularity, POSIX shell support, built-in modules, and easier onboarding.
- Focus is now primarily on the core x-cmd library/framework and its built-in modules, with external skills managed via the `skill` module.
v0.0.7
- Added 24 new extension modules for system info, networking, terminal customization, and security intelligence (e.g., x-arp, x-cpu, x-dns, x-theme, x-shodan, etc.).
- Added specialized installation and regional acceleration guides in the extensions directory.
- Updated install_doc reference to use the new extensions/install-x-cmd.SKILL.md.
- Removed obsolete documentation file data/install.md.
- Expanded SKILL.md with a categorized module reference and links to each module’s documentation.
v0.0.6
- Added LICENSE file.
- Added README.md and README.cn.md documentation.
- Updated version to 0.0.6 in metadata.
v0.0.5
x-cmd 1.0.0
- Added a dedicated installation guide: data/install.md
- Updated SKILL.md to reference the new install documentation and removed in-file security and policy notes
- Removed data/README.md
v0.0.4
v0.0.4 introduces updated installation and security guidance:
- Expanded installation instructions with recommended and alternative methods, including explicit Homebrew usage and script review.
- Added detailed security notes advising against auto-install via `curl | sh` in sensitive environments.
- Introduced an agent auto-install policy outlining when installation is appropriate or prohibited.
- Clarified that users should manually install x-cmd in most cases before using skills.
- No functional changes detected; documentation focused update.
v0.0.3
**Shortened documentation and improved installation instructions.**
- Added `data/README.md` with clear installation options, including Homebrew and curl install.
- Updated docs to emphasize loading x-cmd: `. ~/.x-cmd.root/X` before use.
- Simplified usage guidance and command summaries.
- Highlighted available commands and package management for 600+ tools.
- Outlined security: user-local install, no sudo, auto PATH, isolated packages.
- Provided direct links for more info and skills.
v0.0.2
x-cmd 0.0.2
- Documentation updated to clarify that the skill provides docs only; it does not auto-install x-cmd.
- Added strong security and permission requirements: users must install x-cmd manually and grant permission before agent use.
- Installation and verification instructions are now explicit, including review of install scripts before execution.
- Package sources, installation process, and verification mechanisms (checksums, user-local install) are described in detail.
- Expanded metadata with links to website, install guide, and package sources.
- Security, isolation, and user consent emphasized throughout the documentation.
v0.0.1
- Initial release of x-cmd skill.
- Instantly access and manage 600+ portable software tools (e.g., jq, nodejs, python).
- Simple install and usage via commands like `x env use <pkg>` and `x pixi use <pkg>`.
- No sudo required; user-local installs with automatic PATH configuration.
- Discover more skills and functions using `x skill` and explore at https://www.x-cmd.com/llms.txt.
Metadata
Frequently Asked Questions
What is x-cmd?
Load x-cmd first: `. ~/.x-cmd.root/X`, then explore with `x nihao --llmstxt` or discover skills via `x skill`. x-cmd provides 600+ portable software and deve... It is an AI Agent Skill for Claude Code / OpenClaw, with 454 downloads so far.
How do I install x-cmd?
Run "/install x-cmd" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is x-cmd free?
Yes, x-cmd is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does x-cmd support?
x-cmd is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created x-cmd?
It is built and maintained by Edwin.JH.Lee (@edwinjhlee); the current version is v1.0.1.
More Skills