← Back to Skills Marketplace
open-skills
by
Jonny Looma
· GitHub ↗
· v2.0.1
· MIT-0
74
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install open-skills
Description
一个交互式 CLI 工具，帮助开发者按分类浏览、空格多选、一键批量安装/同步 AI Agent skills 到多个编辑器。
Usage Guidance
Before installing: 1) Verify the package source (npm user/org, repository URL, and commit history); avoid running npx against an unknown publisher. 2) Inspect package.json and any postinstall scripts — npx/npm may run lifecycle scripts. 3) Review the code that writes to editor/config paths (search for target paths in src/core/presets/editors.ts and install/sync code) and back up those editor settings. 4) Expect this tool to perform network downloads and write files into editor skill directories; confirm whether it will execute any downloaded code or spawn runtime processes (Node/Python). 5) If you need least privilege, run the tool in a container or VM first to observe behavior. 6) If you intend to use bundled skills (like deep-research), review those bundles separately — they declare autonomous triggers and perform web searches and file writes (e.g., ~/.claude/research_output/).
Capability Analysis
Type: OpenClaw Skill
Name: open-skills
Version: 2.0.1
The bundle is a legitimate CLI tool and skill set designed to manage AI agent skills and perform 'Deep Research' tasks. The Node.js/TypeScript code implements a skill installer that uses `simple-git` to clone repositories and an internal registry to manage metadata. The Python scripts in the `deep-research` bundle provide a sophisticated research pipeline, including citation verification (via `doi.org`), source credibility scoring, and automated report validation. While the tool possesses significant capabilities—such as network access for Git/Web searches and file system access for report generation—all behaviors are clearly aligned with the stated purpose and are well-documented within the SKILL.md and README.md files. No evidence of malicious intent, data exfiltration, or unauthorized persistence was found.
Capability Tags
Capability Assessment
Purpose & Capability
The repository and SKILL.md match the described purpose: a Node CLI with commands for listing, searching, installing, and syncing skills (src/commands/*.ts, registry resolvers, install/sync code). Bundled skill packages (e.g., deep-research) are reasonably part of a skills manager. However the metadata claims 'required binaries: none' while the package is a Node CLI (package.json, src/cli.ts) and the deep-research bundle documents Python scripts (python3) — so runtime requirements are understated.
Instruction Scope
SKILL.md describes selecting editors and auto-download/convert/install — which implies filesystem writes into editor skill/config locations. The registry metadata lists no required config paths, and the skill README doesn't enumerate exactly which editor paths will be modified. The included deep-research bundle further contains autonomous scripts that perform web searches, spawn agents, and write to ~/.claude/research_output/ — these behaviors are reasonable for that bundled skill but increase the overall attack surface. The instructions do not warn users about file writes, network downloads, or running any language runtimes (Node/Python).
Install Mechanism
There is no formal install spec in the metadata (instruction-only claim) yet README/SKILL.md recommend an npx command ('npx skills add lumacoder/open-skills -g -y'). The project includes package.json and many source files (TypeScript + Python) indicating it is intended to be installed as an npm package, but 'Source: unknown' and 'Homepage: none' create provenance ambiguity. No explicit external download URLs are listed in install metadata; still, npx/npm will fetch code from a registry — verify the published package/author before running. Bundled Python scripts would execute only if invoked, but the presence of scripts increases risk if the installer executes postinstall hooks (no install spec provided to say it doesn't).
Credentials
The skill declares no required environment variables or credentials, which is plausible for a manager that fetches public skills. However the code contains GitHub resolvers, remote resolvers, adapters, and a 'registry' subsystem that will perform network fetches — private repo installs or some adapters could require tokens (not declared). The deep-research bundle documents use of WebSearch and optional Exa MCP tools and includes Python scripts — so additional runtimes/credentials may be necessary for some functionality even though none are declared.
Persistence & Privilege
The skill is not marked always:true and is user-invocable. That is appropriate. However the package contains bundled skills (e.g., deep-research) that are explicitly designed for autonomous operation when triggered (trigger keywords described in deep-research docs). If you install those bundled skills into an agent environment, they may run autonomously when their triggers occur. This is expected behavior for skills but worth noting: autonomous invocation combined with network fetch + file writes increases blast radius.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install open-skills - After installation, invoke the skill by name or use
/open-skills - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.0.1
ahai
Metadata
Frequently Asked Questions
What is open-skills?
一个交互式 CLI 工具，帮助开发者按分类浏览、空格多选、一键批量安装/同步 AI Agent skills 到多个编辑器。 It is an AI Agent Skill for Claude Code / OpenClaw, with 74 downloads so far.
How do I install open-skills?
Run "/install open-skills" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is open-skills free?
Yes, open-skills is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does open-skills support?
open-skills is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created open-skills?
It is built and maintained by Jonny Looma (@lumacoder); the current version is v2.0.1.
More Skills