t

Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express...

This skill is coherent — it helps find and install other skills — but it instructs the agent to fetch and install third‑party code (via npx) and even recommends skipping confirmations and installing globally. Before enabling or letting the agent run this skill autonomously: 1) Prefer manual review of search results and the target skill's GitHub page on skills.sh before installing. 2) Avoid using the '-y' flag or global installs; require explicit user confirmation for any 'npx skills add' operation. 3) If you must allow automated installs, restrict the agent's permission to run shell commands or require a second explicit user approval. 4) Verify the publisher and repository of any skill you install to reduce supply‑chain risk.

Type: OpenClaw Skill Name: t Version: 1.0.0 The skill provides instructions for the agent to search for and install software using the `npx skills` CLI. While aligned with its stated purpose, the instructions in `Skill.md` explicitly direct the agent to use the `-y` flag (`npx skills add <package> -g -y`) to bypass confirmation prompts. This creates a high-risk capability where the agent could be manipulated via prompt injection to silently install malicious third-party packages from the ecosystem without user oversight.