← 返回 Skills 市场
lovelcp

Catchclaw Agentar

作者 kissrain · GitHub ↗ · v3.5.7 · MIT-0
cross-platform ⚠ suspicious
411
总下载
0
收藏
0
当前安装
24
版本数
在 OpenClaw 中安装
/install catch-claw
功能描述
Search, install, and export agentars from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates.
使用说明 (SKILL.md)

CatchClaw Agentar Manager

Source: This skill is from the CatchClaw skill repository.

An agentar is a distributable agent archive (ZIP) containing workspace files such as SOUL.md, skills, and other configuration. It can be installed as a new agent or used to overwrite an existing agent with a single command.

Trigger Conditions

  • User asks to search / find / browse agentars
  • User asks to install / download a specific agentar
  • User asks to export / package an agent as an agentar
  • User asks to rollback / undo / restore a previous agent workspace
  • User mentions the keyword "agentar" or "catchclaw"

Important: Before performing any action, verify the bundled CLI works (see CLI Setup). Do not run search, install, export, or rollback until verification passes.

CLI Setup (mandatory — run before any command)

\x3CHARD-GATE> Before running any search, install, export, or rollback command, you MUST verify the bundled CLI. The CLI (agentar_cli.mjs) is bundled in this skill's directory — no download or copy is needed.

  1. Locate: The CLI is at the same directory as this SKILL.md (e.g. ~/.agents/skills/catchclaw/agentar_cli.mjs).
  2. Verify: Run node \x3Cskill-dir>/agentar_cli.mjs version. Only after it succeeds, proceed with search/install/export/rollback.

Never run $CLI search, $CLI install, $CLI export, or $CLI rollback until verification passes. \x3C/HARD-GATE>

CLI Location

The CLI is bundled in this skill's directory. Run it directly:

node \x3Cskill-dir>/agentar_cli.mjs \x3Ccommand>

Where \x3Cskill-dir> is the directory containing this SKILL.md (e.g. ~/.agents/skills/catchclaw/).

All commands below use $CLI as shorthand for node \x3Cskill-dir>/agentar_cli.mjs.

Environment Variables (optional)

These are listed in metadata.openclaw.requires.env for registry/security analysis. Neither is required for normal use; omit both to use defaults.

  • AGENTAR_API_BASE_URL — Override the default API base URL (defaults to https://catchclaw.me)
  • AGENTAR_HOME — Override the default CLI config directory (defaults to ~/.agentar)

Paths read or written by the bundled CLI

Aligned with metadata.openclaw.requires.config and metadata.json in this skill:

Path Access Purpose
~/.agentar/ read/write CLI config (config.json), optional standalone install copy of agentar_cli.mjs
~/.openclaw/workspace read/write Main agent workspace (install --overwrite, export)
~/.openclaw/agentar-workspaces/ read/write Per-agent workspaces (install --name …)
~/agentar-exports/ write Default directory for export ZIP output
\x3Cskill-dir>/skills/.credentials write (optional) Written when install is run with --api-key

Commands

Search

$CLI search \x3Ckeyword>

Search the CatchClaw marketplace for agentars matching the keyword.

Install

$CLI install \x3Cslug> --name \x3Cname> [--api-key \x3Ckey>]
$CLI install \x3Cslug> --overwrite

Install an agentar from the marketplace.

Options:

  • --name \x3Cname> — Create a new agent with the given name. Existing agents are not affected. (Preferred; list this option first when prompting.)
  • --overwrite — Overwrite the main agent (~/.openclaw/workspace). Existing workspace is backed up automatically. Never use without the user's explicit selection.
  • --api-key \x3Ckey> — (Optional) API key to save into skills/.credentials for agentars that require backend authentication.

Export

$CLI export [--agent \x3Cid>] [-o \x3Cpath>] [--include-memory]

Export an agent as a distributable agentar ZIP package. MEMORY.md is excluded by default. Output defaults to ~/agentar-exports/. Sensitive files (.credentials, .env, .secret, .key, .pem) are automatically filtered out.

Options:

  • --agent \x3Cid> — Agent ID to export. If the user did not specify an agent, you MUST list agents and ask the user to choose before running export; do not export without the user's selection.
  • -o, --output \x3Cpath> — Output ZIP file path.
  • --include-memory — Include MEMORY.md in export (excluded by default).

Rollback

$CLI rollback
$CLI rollback --latest

Restore a workspace from backup. Without --latest, lists all available backups for selection. The current workspace is automatically backed up before restoring, so rollback is always safe.

Version

$CLI version

Show the CLI version.

Installation Rules

\x3CHARD-GATE> Before executing install:

  1. Slug required: If the user wants to install an agentar but has not specified which one (no slug), prompt the user to enter the agentar name/slug to install. Do NOT run install without a slug.
  2. Mode confirmation (CRITICAL - MUST ASK USER): You MUST explicitly ask the user to choose the installation mode. Do NOT proceed with installation until the user has made a clear choice. NEVER assume or default to any mode without user confirmation.

Present the following two options to the user and wait for their response:

  1. new — Create a new agent. The existing agents are not affected.
  2. overwrite — Overwrite the main agent (~/.openclaw/workspace). The existing workspace will be backed up automatically.

Important:

  • Do NOT execute install until the user explicitly selects one of the above options
  • Do NOT use "new" as a default without asking
  • Do NOT use "overwrite" unless the user explicitly selects it
  • If the user chooses "new" but doesn't specify a name, use the slug as the default name

After the user explicitly selects "new", execute: $CLI install \x3Cslug> --name \x3Cuser-specified name> After the user explicitly selects "overwrite", execute: $CLI install \x3Cslug> --overwrite

Never execute install without both: (1) a slug, and (2) explicit user confirmation of installation mode. \x3C/HARD-GATE>

Export Rules

\x3CHARD-GATE> When the user has not specified which agent to export, you MUST let the user choose first. Do NOT export on your own. If --agent \x3Cid> was not provided by the user:

  1. Run $CLI export without --agent to list available agents (or equivalent to show choices).
  2. Present the list to the user and ask which agent to export.
  3. Only after the user explicitly selects an agent, run $CLI export --agent \x3Cuser-selected-id> (and optional -o, --include-memory as needed). Never assume or pick an agent for the user. \x3C/HARD-GATE>
  • MEMORY.md is excluded by default. Only include it if the user explicitly requests it with --include-memory.
  • Sensitive files are automatically filtered out during export (.credentials, .env, .secret, .key, .pem).
  • After a successful export, remind the user to review the exported ZIP for any sensitive data (API keys, credentials, personal information).
  • Export is a purely local operation — it does not require network access.

Error Handling

Error Action
CLI file not found Verify the skill is installed correctly — agentar_cli.mjs should be in the skill directory
API unreachable or network error Suggest checking network connectivity, or override the API URL with: export AGENTAR_API_BASE_URL=\x3Curl>
Node.js not installed Instruct user to install Node.js from https://nodejs.org/
Download or extraction failure Show the error message and suggest retrying the command

Workflow

  1. Search: Run $CLI search \x3Ckeyword> to find agentars. Each result includes a slug identifier.
  2. Install: If the user did not specify which agentar to install (no slug), ask the user to enter the agentar name/slug. Then confirm installation mode: present [1] new, [2] overwrite; never use overwrite without explicit user selection. Only after you have both slug and mode, execute the install command.
  3. Export: If the user did not specify which agent to export, run $CLI export (no --agent) to list agents, present the list to the user, and ask them to choose. Only after the user selects an agent, run $CLI export --agent \x3Cid>. Do not export without the user's explicit selection.
  4. Rollback: If the user wants to undo an overwrite install, run $CLI rollback to list available backups and restore one.
安全使用建议
This skill appears to do what it claims: it runs a bundled Node CLI to talk to a CatchClaw marketplace, download agentar ZIPs, and read/write OpenClaw workspaces. Before using it: 1) Verify the CLI locally as SKILL.md requires (run `node <skill-dir>/agentar_cli.mjs version`) and inspect the code if you have concerns. 2) Note that registry metadata says two env vars are required but the SKILL.md says they are optional — you can omit them to use defaults; set AGENTAR_API_BASE_URL only if you need a custom server. 3) When installing, be explicit about install mode (new vs overwrite) and avoid passing API keys unless you trust the agentar; supplied keys are saved to a local skills/.credentials file. 4) If you need higher assurance, review the full agentar_cli.mjs (it uses only Node builtins but includes a slightly unusual dynamic lookup of child_process, which appears functional rather than malicious).
功能分析
Type: OpenClaw Skill Name: catch-claw Version: 3.5.7 The skill provides agent management functionality (search, install, export) but contains obfuscated code in `agentar_cli.mjs` to resolve the `child_process` module (using `builtinModules.find` with character matching), a common technique for evading static analysis. While the script includes security-conscious logic—such as explicitly filtering sensitive files (.env, .key, .credentials) during exports and creating backups before overwriting workspaces—the intentional hiding of process execution capabilities is a significant red flag. The CLI also performs 'metadata enrichment' by programmatically prompting the agent via the `openclaw` binary, which creates a complex self-invocation loop.
能力评估
Purpose & Capability
Name/description, the bundled Node CLI, and the declared config paths (~/.agentar, ~/.openclaw/workspace, agentar-exports) all align with a tool that finds, installs, and packages agent archives. Requiring the node binary is expected.
Instruction Scope
SKILL.md instructs the agent to verify and then run the bundled CLI to search/install/export/rollback; all referenced files and operations (backup, overwrite, export filtering of sensitive files) are within the skill's stated domain. One procedural inconsistency: the registry marks AGENTAR_API_BASE_URL and AGENTAR_HOME as required env vars, but SKILL.md explicitly says both are optional and defaults exist.
Install Mechanism
There is no external install step; the CLI is bundled in the skill and uses only Node builtins. The CLI performs HTTP requests and may download agentar ZIPs from the marketplace URL (default https://catchclaw.me), which is expected behavior for this purpose.
Credentials
Only two env vars are referenced (API base URL and CLI home), and they are optional per SKILL.md — this is proportional. The skill will read/write the listed OpenClaw workspace paths and may write a local skills/.credentials file if the user supplies an --api-key. The registry's 'required env vars' claim is misleading.
Persistence & Privilege
The skill does not request always:true, and autonomous invocation is default but not excessive here. It persists data only to its own CLI home (~/.agentar), backups, and OpenClaw workspace locations it manages as part of install/export/rollback, which is consistent with its functionality.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install catch-claw
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /catch-claw 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v3.5.7
skill-v3.5.7 release
v3.5.6
fix suspicious issue
v3.5.5
fix windows bug
v3.5.4
fix security issue
v3.5.3
- fix(skill): restore dynamic child_process loading to pass marketplace scanner;
v3.5.2
- fix(skill): use direct child_process import and restrict binary search paths;
v3.5.1
- fix(skill): avoid static-analysis false positive for subprocess import;
v3.5.0
add more features
v3.4.1
- fix: zip compatibility - CP437 filename decoding and Windows path sep;
v3.4.0
- fix: rewrite extractZip to use central directory for accurate sizes;
v3.3.9
skill-v3.3.9 release
v3.3.8
- fix: declare env vars and run CLI from skill dir directly;
v3.3.7
- fix: remove static child_process import to pass security scan;
v3.3.6
- fix: replace spawnSync with fs lookup in findOpenclawBin;
v3.3.5
- fix: preserve skill metadata fields during release build;- fix(catchclaw): 更新CLI设置流程并添加新文件;
v3.3.3
fix security issues
v3.3.1
- fix: reset metadata.json version to match tarball (3.3.0);- fix: remove agentar_cli.mjs references from release-skill.sh;- chore(cli): 更新版本号并添加强制重装选项;- chore(cli): 更新版本号并添加强制重装选项;- refactor(install.ps1): 统一路径拼接方式;- docs(agentar/SKILL.md): 更新技能文档;- fix(cli): 改进错误处理并启用shell模式;- fix(SKILL.md): 更新技能名称为agentar;- chore(cli): 更新版本号并修正安装指令格式;- fix(AgentarManagerImpl): 修改获取包指令返回值中的表述错误;
v3.2.0
Security fix: replace execSync with spawnSync to prevent shell injection, add input validation for slugs and paths, remove OS metadata from exports.
v3.1.0
Initial release of CatchClaw skill for clawhub. Self-contained agentar CLI for searching, installing, and exporting agent templates. Cross-platform support (macOS, Linux, Windows).
v1.1.5
v1.1.5 release
元数据
Slug catch-claw
版本 3.5.7
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 24
常见问题

Catchclaw Agentar 是什么?

Search, install, and export agentars from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 411 次。

如何安装 Catchclaw Agentar?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install catch-claw」即可一键安装,无需额外配置。

Catchclaw Agentar 是免费的吗?

是的,Catchclaw Agentar 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

Catchclaw Agentar 支持哪些平台?

Catchclaw Agentar 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Catchclaw Agentar?

由 kissrain(@lovelcp)开发并维护,当前版本 v3.5.7。

💬 留言讨论