← 返回 Skills 市场
aliezu

catchclaw-bak

作者 aLIEzu · GitHub ↗ · v1.0.11 · MIT-0
cross-platform ✓ 安全检测通过
171
总下载
0
收藏
0
当前安装
12
版本数
在 OpenClaw 中安装
/install catchclaw-bak
功能描述
Search, install, and export agentars from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates.
使用说明 (SKILL.md)

CatchClaw Agentar Manager

Source: This skill is from the CatchClaw skill repository.

An agentar is a distributable agent archive (ZIP) containing workspace files such as SOUL.md, skills, and other configuration. It can be installed as a new agent or used to overwrite an existing agent with a single command.

Trigger Conditions

  • User asks to search / find / browse agentars
  • User asks to install / download a specific agentar
  • User asks to export / package an agent as an agentar
  • User asks to rollback / undo / restore a previous agent workspace
  • User mentions the keyword "agentar" or "catchclaw"

Important: Before performing any action, verify the bundled CLI works (see CLI Setup). Do not run search, install, export, or rollback until verification passes.

CLI Setup (mandatory — run before any command)

\x3CHARD-GATE> Before running any search, install, export, or rollback command, you MUST verify the bundled CLI. The CLI (agentar_cli.mjs) is bundled in this skill's directory — no download or copy is needed.

  1. Locate: The CLI is at the same directory as this SKILL.md (e.g. ~/.agents/skills/catchclaw/agentar_cli.mjs).
  2. Verify: Run node \x3Cskill-dir>/agentar_cli.mjs version. Only after it succeeds, proceed with search/install/export/rollback.

Never run $CLI search, $CLI install, $CLI export, or $CLI rollback until verification passes. \x3C/HARD-GATE>

CLI Location

The CLI is bundled in this skill's directory. Run it directly:

node \x3Cskill-dir>/agentar_cli.mjs \x3Ccommand>

Where \x3Cskill-dir> is the directory containing this SKILL.md (e.g. ~/.agents/skills/catchclaw/).

All commands below use $CLI as shorthand for node \x3Cskill-dir>/agentar_cli.mjs.

Environment Variables (optional)

These are listed in metadata.openclaw.requires.env for registry/security analysis. Neither is required for normal use; omit both to use defaults.

  • AGENTAR_API_BASE_URL — Override the default API base URL (defaults to https://catchclaw.me)
  • AGENTAR_HOME — Override the default CLI config directory (defaults to ~/.agentar)

Paths read or written by the bundled CLI

Aligned with metadata.openclaw.requires.config and metadata.json in this skill:

Path Access Purpose
~/.agentar/ read/write CLI config (config.json), optional standalone install copy of agentar_cli.mjs
~/.openclaw/workspace read/write Main agent workspace (install --overwrite, export)
~/.openclaw/agentar-workspaces/ read/write Per-agent workspaces (install --name …)
~/agentar-exports/ write Default directory for export ZIP output
\x3Cskill-dir>/skills/.credentials write (optional) Written when install is run with --api-key

Commands

Search

$CLI search \x3Ckeyword>

Search the CatchClaw marketplace for agentars matching the keyword.

Install

$CLI install \x3Cslug> --name \x3Cname> [--api-key \x3Ckey>]
$CLI install \x3Cslug> --overwrite

Install an agentar from the marketplace.

Options:

  • --name \x3Cname> — Create a new agent with the given name. Existing agents are not affected. (Preferred; list this option first when prompting.)
  • --overwrite — Overwrite the main agent (~/.openclaw/workspace). Existing workspace is backed up automatically. Never use without the user's explicit selection.
  • --api-key \x3Ckey> — (Optional) API key to save into skills/.credentials for agentars that require backend authentication.

Export

$CLI export [--agent \x3Cid>] [-o \x3Cpath>] [--include-memory]

Export an agent as a distributable agentar ZIP package. MEMORY.md is excluded by default. Output defaults to ~/agentar-exports/. Sensitive files (.credentials, .env, .secret, .key, .pem) are automatically filtered out.

Options:

  • --agent \x3Cid> — Agent ID to export. If the user did not specify an agent, you MUST list agents and ask the user to choose before running export; do not export without the user's selection.
  • -o, --output \x3Cpath> — Output ZIP file path.
  • --include-memory — Include MEMORY.md in export (excluded by default).

Rollback

$CLI rollback
$CLI rollback --latest

Restore a workspace from backup. Without --latest, lists all available backups for selection. The current workspace is automatically backed up before restoring, so rollback is always safe.

Version

$CLI version

Show the CLI version.

Installation Rules

\x3CHARD-GATE> Before executing install:

  1. Slug required: If the user wants to install an agentar but has not specified which one (no slug), prompt the user to enter the agentar name/slug to install. Do NOT run install without a slug.
  2. Mode confirmation (CRITICAL - MUST ASK USER): You MUST explicitly ask the user to choose the installation mode. Do NOT proceed with installation until the user has made a clear choice. NEVER assume or default to any mode without user confirmation.

Present the following two options to the user and wait for their response:

  1. new — Create a new agent. The existing agents are not affected.
  2. overwrite — Overwrite the main agent (~/.openclaw/workspace). The existing workspace will be backed up automatically.

Important:

  • Do NOT execute install until the user explicitly selects one of the above options
  • Do NOT use "new" as a default without asking
  • Do NOT use "overwrite" unless the user explicitly selects it
  • If the user chooses "new" but doesn't specify a name, use the slug as the default name

After the user explicitly selects "new", execute: $CLI install \x3Cslug> --name \x3Cuser-specified name> After the user explicitly selects "overwrite", execute: $CLI install \x3Cslug> --overwrite

Never execute install without both: (1) a slug, and (2) explicit user confirmation of installation mode. \x3C/HARD-GATE>

Export Rules

\x3CHARD-GATE> When the user has not specified which agent to export, you MUST let the user choose first. Do NOT export on your own. If --agent \x3Cid> was not provided by the user:

  1. Run $CLI export without --agent to list available agents (or equivalent to show choices).
  2. Present the list to the user and ask which agent to export.
  3. Only after the user explicitly selects an agent, run $CLI export --agent \x3Cuser-selected-id> (and optional -o, --include-memory as needed). Never assume or pick an agent for the user. \x3C/HARD-GATE>
  • MEMORY.md is excluded by default. Only include it if the user explicitly requests it with --include-memory.
  • Sensitive files are automatically filtered out during export (.credentials, .env, .secret, .key, .pem).
  • After a successful export, remind the user to review the exported ZIP for any sensitive data (API keys, credentials, personal information).
  • Export is a purely local operation — it does not require network access.

Error Handling

Error Action
CLI file not found Verify the skill is installed correctly — agentar_cli.mjs should be in the skill directory
API unreachable or network error Suggest checking network connectivity, or override the API URL with: export AGENTAR_API_BASE_URL=\x3Curl>
Node.js not installed Instruct user to install Node.js from https://nodejs.org/
Download or extraction failure Show the error message and suggest retrying the command

Workflow

  1. Search: Run $CLI search \x3Ckeyword> to find agentars. Each result includes a slug identifier.
  2. Install: If the user did not specify which agentar to install (no slug), ask the user to enter the agentar name/slug. Then confirm installation mode: present [1] new, [2] overwrite; never use overwrite without explicit user selection. Only after you have both slug and mode, execute the install command.
  3. Export: If the user did not specify which agent to export, run $CLI export (no --agent) to list agents, present the list to the user, and ask them to choose. Only after the user selects an agent, run $CLI export --agent \x3Cid>. Do not export without the user's explicit selection.
  4. Rollback: If the user wants to undo an overwrite install, run $CLI rollback to list available backups and restore one.
安全使用建议
This skill appears to do what it says: it bundles a Node.js CLI that will read/write your OpenClaw agent workspaces and can save an API key only if you pass --api-key. Before installing or invoking: 1) Confirm you trust the skill source (GitHub link provided). 2) Always follow the SKILL.md instruction to run `node <skill-dir>/agentar_cli.mjs version` to verify the bundled CLI before any install/export. 3) When installing, explicitly choose 'new' or 'overwrite'—do not allow the skill to assume overwrite. 4) Be aware it will read/write ~/.openclaw/workspace and related paths and will write backups; if you have sensitive agent data, back it up separately. 5) Clarify the metadata mismatch about whether AGENTAR_API_BASE_URL and AGENTAR_HOME are required or optional (they are documented as optional overrides). If you do not trust the source or prefer to avoid writing any credentials, do not pass --api-key.
功能分析
Type: OpenClaw Skill Name: catchclaw-bak Version: 1.0.11 The CatchClaw Agentar Manager is a utility for managing agent archives (agentars). The bundled CLI (agentar_cli.mjs) is well-implemented using native Node.js modules and includes several proactive security measures, such as filtering sensitive files (.env, .credentials, .key) during export, validating slugs and paths against injection patterns, and restricting binary lookups to a whitelist of trusted system directories (e.g., /usr/bin, /opt/homebrew/bin). The SKILL.md instructions include mandatory 'hard gates' that force the AI agent to verify the CLI and obtain explicit user confirmation before performing destructive actions like overwriting workspaces. The behavior is entirely consistent with the stated purpose, and no indicators of malicious intent or data exfiltration were found.
能力评估
Purpose & Capability
The skill is a bundled Node.js CLI for searching, installing, exporting agentar packages. Requiring node, config paths (~/.agentar, ~/.openclaw/workspace, ~/.openclaw/agentar-workspaces, ~/agentar-exports) and an API base URL is appropriate for this functionality. Writing optional per-agent credentials into skills/.credentials when the user provides --api-key is consistent with supporting agentars that need backend auth.
Instruction Scope
SKILL.md constrains behavior (mandates verifying the bundled CLI with `node <skill-dir>/agentar_cli.mjs version` before any operations, requires explicit user confirmation of install mode, and forbids implicit overwrites). The CLI and instructions operate on the declared workspace/config paths only. Minor inconsistency: the registry summary listed AGENTAR_API_BASE_URL and AGENTAR_HOME as "required env vars", while SKILL.md and metadata.json state they are optional (overrides). This should be clarified but does not indicate malicious behavior.
Install Mechanism
There is no external install step or remote download; the CLI is bundled in the skill. The included agentar_cli.mjs only uses Node built-ins (no third-party network-installed packages) and does not fetch arbitrary code at install time. This is a low-risk install model.
Credentials
The only environment variables referenced (AGENTAR_API_BASE_URL and AGENTAR_HOME) are reasonable for overriding defaults; metadata.json marks them optional. The skill accesses workspace/config directories that are appropriate for installing/exporting agent templates. It can store an API key into a skills/.credentials file only if the user supplies --api-key — which is proportional. Clarify the metadata vs. SKILL.md divergence about whether those env vars are required.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. It reads/writes the agent workspace and its own CLI/config under ~/.agentar; it does not request system-wide privileges or modify other skills. It may spawn the local openclaw binary for optional enrichment but uses trusted-path checks and spawnSync with shell:false to reduce command-injection/PATH-hijack risk.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install catchclaw-bak
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /catchclaw-bak 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.11
- No file changes detected in this version. - Documentation, behavior, and usage rules remain unchanged from previous release.
v1.0.10
No changes detected in this version. - There are no file or documentation updates for version 1.0.10. - Behavior and rules remain unchanged from the previous release.
v1.0.9
Version 1.0.9 (no file changes detected): - No code or documentation changes in this version. - Behavior, commands, and usage instructions remain unchanged.
v1.0.8
- No changes detected in files for this release. - Version update only; behavior and documentation remain unchanged.
v1.0.7
- Added `user-invocable: true` flag to SKILL.md for improved discoverability and invocation. - Introduced `metadata.openclaw` section specifying skill emoji, homepage, required binaries, environment variables, and config paths. - Documented CLI-related config and data paths in a new table, aligning with metadata and improving transparency of file usage. - Clarified that environment variables are optional and listed for registry/security analysis. - No changes to skill commands or core usage instructions.
v1.0.6
catchclaw-bak 1.0.6 Changelog - SKILL.md: No user-facing or functional changes detected. - No significant updates or modifications were made in this version. - Maintains previous behavior and usage instructions.
v1.0.5
- No code or documentation changes in this version. - Version incremented with no detected modifications.
v1.0.4
## catchclaw-bak 1.0.4 - Removed the file `openclaw_spawn.mjs`. - No other changes to commands, workflow, or documentation.
v1.0.3
Version 1.0.3 - Added new file: openclaw_spawn.mjs - No changes to workflow, commands, or documented behavior in SKILL.md
v1.0.2
No changes were made in this version. - Version 1.0.2 introduces no modifications; SKILL.md is unchanged and no file changes were detected.
v1.0.1
Version 1.0.1 of catchclaw-bak - No file changes detected in this release. - No updates to functionality, CLI usage, or documentation.
v1.0.0
CatchClaw Agentar Manager (v1.0.0) — initial release: - Enables search, installation, export, and rollback of agentar packages from the CatchClaw marketplace via a bundled CLI. - CLI verification is required before any action; explicit, step-by-step user confirmation enforced for safety during install/export. - Install mode must be explicitly chosen by the user (“new” or “overwrite”); never default or assume. - Export process requires explicit agent selection by user and excludes sensitive files by default. - Rollback feature included to safely restore previous agent workspace backups.
元数据
Slug catchclaw-bak
版本 1.0.11
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 12
常见问题

catchclaw-bak 是什么?

Search, install, and export agentars from the CatchClaw marketplace. Use when the user wants to find, install, or package agent templates. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 171 次。

如何安装 catchclaw-bak?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install catchclaw-bak」即可一键安装,无需额外配置。

catchclaw-bak 是免费的吗?

是的,catchclaw-bak 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

catchclaw-bak 支持哪些平台?

catchclaw-bak 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 catchclaw-bak?

由 aLIEzu(@aliezu)开发并维护,当前版本 v1.0.11。

💬 留言讨论