Skill Exporter

Export Clawdbot skills as standalone, deployable microservices. Use when you want to dockerize a skill, deploy it to Railway or Fly.io, or create an independent API service. Generates Dockerfile, FastAPI wrapper, requirements.txt, deployment configs, and optional LLM client integration.

This exporter appears to do what it says, but review the generated service before deploying. Specific suggestions: (1) inspect generated api.py for the wide-open CORS policy and adjust or add authentication if the service will be public; (2) review any subprocess calls and copied scripts to ensure they don't run unsafe commands or expect secrets embedded in code; (3) the exporter will detect and surface environment variable NAMES from the source skill and create a .env.example — do not put real secret values into the source skill's .env when running the exporter (work on a sanitized copy) and do not commit .env with secrets to source control; (4) if you enable --llm you will need to provide provider API keys at runtime — only supply keys you trust and scope them appropriately; and (5) test the generated docker image locally before deploying to Railway/Fly or exposing it to the internet.

Type: OpenClaw Skill Name: skill-exporter Version: 1.0.0 The skill-exporter is designed to transform existing Clawdbot skills into standalone microservices. The `SKILL.md` provides clear, benign instructions for its use and does not contain any prompt injection attempts. The `scripts/export.py` script performs file system operations (reading source skill files, writing generated service files, copying scripts) and analyzes the source skill's code to infer dependencies and environment variables. These actions are all directly aligned with its stated purpose of code generation and packaging. There is no evidence of intentional harmful behavior such as data exfiltration, unauthorized execution, persistence mechanisms, or obfuscation within the exporter skill itself. The potential for a *generated* service to be risky depends on the *input skill* it processes, not on the exporter skill's inherent maliciousness.