OpenClaw Skill Publisher

OpenClaw 技能包的发布与管理技能。当用户需要将技能发布到 ClawHub 或 Gitee、 创建新技能、更新技能版本、通用化技能内容、或管理多渠道分发时使用此技能。 触发场景：用户提到"发布技能"、"发布到技能商店"、"skill publish"、"上传Gitee"、 "技能通用化"、"技能包管理"、"...

This skill's instructions are plausible for publishing skills (download Node, install clawhub, use tokens to publish/upload files), but the package metadata does not declare the credentials and filesystem accesses the instructions require. Before installing or letting an agent run these steps: 1) Do not paste tokens into chat — store tokens in a secure vault or provide them via the platform's secure env var mechanism (and prefer short-lived/minimally-scoped tokens). 2) Review the clawhub npm package source and verify you trust the publisher before installing global npm packages. 3) If you must run these steps, run them in an isolated/test environment or container so any npm-installed code can't access unrelated files. 4) Confirm the skill manifest is updated to declare required env vars/config paths (ClawHub token, Gitee PAT, access to skill files) so the platform can present accurate permission prompts. 5) If you cannot verify the npm package or do not want to grant filesystem/network access to an autonomous agent, perform publishing steps manually instead.

Type: OpenClaw Skill Name: ruyue-skill-publisher Version: 1.0.0 The skill provides instructions for the agent to download and install a portable Node.js environment from nodejs.org, install the 'clawhub' CLI globally, and manage API tokens for Gitee and ClawHub. While these actions are consistent with the stated purpose of publishing and managing skill bundles, the execution of remote binaries, the use of shell commands to bypass execution policies (via cmd /c), and the handling of sensitive credentials represent high-risk behaviors. These procedures are detailed in SKILL.md as necessary workarounds for sandbox limitations, but they lack sufficient input sanitization or security guardrails.