SkillMe

Use when user asks to find, search, add, or install skills, or discover agent capabilities. Also triggers on 'install skills', 'add skills', 'is there a skil...

This skill's purpose (finding and installing skills) is reasonable, but before installing or using it you should: 1) Ensure your environment has the tools it actually uses (clawhub, node/npm for npx, python3) or understand it will fail; the skill metadata does not list these requirements. 2) Be cautious about running the recommended npx commands (especially with -g -y) — npx can execute arbitrary remote package code. Prefer installing skills from well-known authors and inspect the SKILL.md and repository before adding. 3) Avoid running installs as root or into /root/.openclaw; pick a non-privileged workspace path. 4) When asked to convert or install a skill, manually review the fetched SKILL.md (the convert script fetches raw GitHub URLs) before writing/executing. 5) If you do not want the agent to autonomously install third-party code, disable autonomous invocation for this skill or require explicit user confirmation before performing installs. Overall: OK to use for discovery, but treat installation steps as potentially risky and verify sources and contents before proceeding.

Type: OpenClaw Skill Name: skillme Version: 1.0.0 The 'skillme' bundle is a utility designed to search and install agent skills from ClawHub and skills.sh. It includes a Python script (scripts/convert_skillssh.py) that fetches markdown content from GitHub and reformats it for OpenClaw. While the skill executes shell commands (clawhub, npx) and performs network requests, these actions are entirely consistent with its stated purpose of skill discovery and management. No evidence of data exfiltration, malicious persistence, or intentional exploitation was found.