← Back to Skills Marketplace
fff
by
sundayslove
· GitHub ↗
· v2.0.0
· MIT-0
121
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install testskillhhh
Description
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express...
Usage Guidance
This skill is coherent for finding skills, but take precautions before using it: 1) Verify the source/author — the embedded _meta.json owner/slug/version differ from the registry metadata shown; confirm you trust the publisher. 2) Never run 'npx skills add ... -g -y' as-is — avoid global installs and skip-confirm flags; require that installs be confirmed and inspected first. 3) Prefer installing locally or in a sandbox, and inspect the package/repo before running. 4) If you allow the agent to act autonomously, disable non-interactive installs or require explicit user confirmation for every install. 5) If in doubt, ask the skill to show the exact repo URL and a link to its source on GitHub/skills.sh and review the code manually before proceeding.
Capability Analysis
Type: OpenClaw Skill
Name: testskillhhh
Version: 2.0.0
The skill 'testskillhhh' (Find Skills) provides instructions for an AI agent to search for and install third-party packages using the 'npx skills' CLI. While this aligns with its stated purpose, the SKILL.md file explicitly directs the agent to use the '-y' and '-g' flags (e.g., 'npx skills add <package> -g -y'), which bypasses user confirmation and installs code globally. This creates a high-risk path for the automated execution of remote code from unverified sources like GitHub or skills.sh without manual oversight.
Capability Assessment
Purpose & Capability
The SKILL.md describes a find/install helper and the suggested commands (npx skills find/add) are consistent with that purpose. However, the registry metadata shown to you (owner, slug, version) does not match the _meta.json embedded in the package (different ownerId, slug, version). That discrepancy could indicate a copy/paste, republishing under a different identity, or packaging mistake and warrants verification before trust.
Instruction Scope
Instructions are narrowly scoped to searching and installing skills using the Skills CLI (npx skills). They do not request unrelated files or environment variables. Concern: the README explicitly recommends running installs with -g and -y (global + skip confirmations), which encourages non-interactive global installation of third-party code — this expands the impact of any mistaken or malicious install.
Install Mechanism
No install spec in the package itself (instruction-only). The runtime instructions rely on 'npx skills' which will download and run packages from npm/GitHub. That is an expected mechanism for a skills-discovery helper, but it inherently allows arbitrary remote code execution when used. Users should treat 'npx skills add' as privileged and review sources before running.
Credentials
The skill does not request environment variables, credentials, or config paths. That is proportionate to its described role. Still, the recommended global installations affect user environment and should be treated cautiously.
Persistence & Privilege
always:false (good), but model invocation is allowed (default). Combined with instructions that recommend non-interactive, global installs, an agent that invokes this skill autonomously could install and execute other skills without explicit human confirmation. If you allow autonomous installs, this increases blast radius.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install testskillhhh - After installation, invoke the skill by name or use
/testskillhhh - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.0.0
Initial release of the "find-skills" capability.
- Helps users discover and install agent skills for specialized tasks.
- Guides users on when and how to search for skills using the Skills CLI.
- Provides step-by-step instructions and example queries for finding relevant skills.
- Explains how to install, update, and check for skill updates.
- Includes strategies for effective skill searches and suggestions for next steps if no skill is found.
v1.0.0
test-skill 1.0.0 – Initial release
- Introduces a comprehensive framework for performance benchmarking, context continuity, and edge-case validation.
- Provides modules for load testing, shared-context evaluation, and capability boundary analysis.
- Includes a structured validation matrix detailing objectives and success criteria for each test type.
- Outlines an execution protocol for initiating test sequences with customizable parameters.
Metadata
Frequently Asked Questions
What is fff?
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... It is an AI Agent Skill for Claude Code / OpenClaw, with 121 downloads so far.
How do I install fff?
Run "/install testskillhhh" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is fff free?
Yes, fff is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does fff support?
fff is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created fff?
It is built and maintained by sundayslove (@sundayslove); the current version is v2.0.0.
More Skills