Skill Discovery

基于用户意图发现并推荐 skill。分析用户输入，搜索匹配 skill，验证质量后推荐最佳匹配，由用户确认后安装。

This skill appears internally consistent and implements a recommendation-first workflow (dry-run) by default. Before installing or enabling it as an automatic hook, consider: 1) it will run 'npx skills' commands and may call the public ClawHub API (clawhub.ai) — ensure outbound network access to that host is acceptable; 2) it writes sanitized logs to $OPENCLAW_DIR/logs/skill-discovery-v3.json and stores uninstall backups in a .trash directory under the configured path (defaults to your home .openclaw) — verify the log/backup locations and retention meet your privacy/storage needs; 3) automatic installation only occurs if explicitly invoked with dryRun: false or explicit CLI flags — review the install command before consenting to install any discovered skill; 4) the code uses child_process.exec but implements shell escaping for user inputs; if you have strict security requirements, inspect the sanitize() implementation and the trustedOwners list to confirm they match your policy. Overall, nothing in the package requests unexplained credentials or hidden endpoints.