Skill Combinator — Emergent Capabilities Engine

Meta-skill that unlocks emergent capabilities by combining your agent's installed skills in non-obvious ways. Use this skill whenever your agent faces a comp...

This skill appears internally consistent for discovering and cataloging multi-skill combinations, but review a few operational details before installing: - Confirm how OpenClaw delivers Telegram reports: is the platform the sender (skill provides only content) or could the agent perform HTTP calls? Prefer platform-mediated delivery so the skill itself never performs network requests. - Check the contents of AGENTS.md and MEMORY.md in your workspace; they may contain sensitive policy or user memory. The skill reads these files (read-only) to inform distillation — ensure nothing secret is stored there or that you are comfortable with read access. - Limit the Telegram bot token's scope (use a bot restricted to the intended chat), rotate the token if needed, and do not reuse a token with broader permissions. - Inspect other installed SKILL.md files for any sensitive content before allowing the combinator to read them; the skill intends to extract name+description but the grep/cat approach reads the files locally. - Validate the cron job/session configuration in OpenClaw (isolated session recommended) and verify the constraints in cron-message.md are enforced by the platform (e.g., prohibition on installing new skills autonomously, not writing AGENTS.md/SOUL.md). If you want stronger assurance, request documentation from the platform about notification mediation and a runtime audit log showing that the skill only read the declared files and did not perform outbound network calls. If you cannot confirm these, treat the read access to MEMORY.md/AGENTS.md as a potential privacy risk.

Type: OpenClaw Skill Name: skill-combinator Version: 1.0.2 The skill acts as a meta-analyzer that inventories all installed skills and workspace logs to identify 'emergent capabilities.' While the intent appears helpful, it requires broad read access to the entire `/workspace/skills/` directory and core configuration files like `AGENTS.md` and `MEMORY.md`, as well as access to the `TELEGRAM_BOT_TOKEN`. The 'Weekly Distillation' logic (defined in `SKILL.md` and `cron-message.md`) processes entries from `LEARNINGS.md`, which introduces a risk of indirect prompt injection if those logs contain unsanitized data from other skills or external missions.