skill-recommender

Find, filter, cluster, and recommend similar OpenClaw skills by intent, function, or use case. Use when the user wants to find同类 skill、比较多个相近 skill、判断哪个 skil...

This skill appears to be what it says: a local recommender that reads SKILL.md files in a skills directory and ranks/clusters them. Before installing or running it: (1) Confirm you intend to let it read the specified skills_dir — any SKILL.md files there will be read; avoid pointing it at directories that contain secrets. (2) Be aware of a correctness issue: match-type labels may underrepresent confidence because scoring and label thresholds are misaligned. (3) If you want extra assurance, inspect the three scripts yourself or run them against a small test directory in a sandboxed environment to verify behavior. No network calls or secret exfiltration were found in the code.

Type: OpenClaw Skill Name: skill-recommender Version: 0.1.0 The skill bundle contains scripts (recommend_skills.js, check_skill_dedup.js, cluster_skills.js) that perform file system operations based on user-provided directory paths without sanitization, creating a potential path traversal vulnerability. Additionally, SKILL.md includes a hardcoded absolute path belonging to a specific local user ('/Users/jianghaidong/'), which is a minor information leak and suggests the code may not have been properly audited for distribution. While the logic appears aligned with the stated purpose of recommending skills, the lack of input validation on file paths is a security flaw.