Skills Finder

Intelligent skill matcher that searches multiple skill marketplaces (ClawHub & Skills.sh) in real-time. Supports ANY language for user input, multi-step skil...

This skill appears to do what it says (search and install skills) but has two things to consider before installing: 1) Metadata mismatch: the registry header claims no required binaries, while SKILL.md/_meta.json require Node.js/npx (and optionally curl/jq). Confirm you have Node/npm and that the registry metadata is accurate. 2) Runtime npx usage: the script runs commands like 'npx clawhub@latest' and 'npx skills find' which download and execute code from the npm registry at runtime (and use the @latest tag). That behavior is expected for a 'finder/installer' but is a supply-chain risk — a malicious or compromised npm package (or a hijacked package name) could execute arbitrary code on your system. To reduce risk, prefer pinned versions, verify the upstream package authors (clawhub, skills), inspect those CLIs' source repositories, or run in a sandboxed environment. Also verify any skill you install via this tool before granting it broader agent permissions. Optional checks: review the referenced GitHub homepage in _meta.json, ensure clawhub/skills CLIs are the official packages you expect, and consider requesting a packaged install (pinned versions or an audit) instead of runtime @latest execution.

Type: OpenClaw Skill Name: skills-finder Version: 1.6.0 The skills-finder bundle is a utility for searching and installing agent skills from the ClawHub and Skills.sh marketplaces. The core logic in `scripts/skill-finder.sh` uses standard CLI tools (via `npx`) to perform searches and installations based on user queries, including basic language detection and task chaining logic. No evidence of data exfiltration, unauthorized access, or malicious prompt injection was found; the behavior aligns with the stated purpose of skill discovery.