← 返回 Skills 市场

Local Claw Skill Nest Client

Name: Local Claw Skill Nest Client
Author: kklldog

作者 Minjie.ZHOU · GitHub ↗ · v1.0.3 · MIT-0

cross-platform ⚠ suspicious

289

总下载

当前安装

版本数

在 OpenClaw 中安装

/install claw-skill-nest-client

功能描述

本地/私有 Claw Skill Nest（也可称“虾滑” / “Xiahua”）客户端，支持列出、上传、安装、更新技能；当用户提到上传到虾滑、上传到 Xiahua、从虾滑安装技能、从 Xiahua 安装技能、从本地 claw-skill-nest 安装/更新技能时使用；不用于 clawhub.com。

使用说明 (SKILL.md)

Local Claw Skill Nest Client

本技能是 本地/私有 Claw Skill Nest 的客户端，也可以理解为本地技能仓库客户端；在当前语境里，“虾滑” 和 “Xiahua” 都指这个本地 Claw Skill Nest。

用于管理 skills：

列出（list）
上传（upload）
安装（install）
更新（update）

边界说明（重要）：

仅面向 local/private Claw Skill Nest。

“虾滑” / “Xiahua” 在本技能中视为本地 Claw Skill Nest 的别称。

不用于 ClawHub 公共仓库（clawhub.com）。

环境变量

SKILLHUB_URL - 本地 Claw Skill Nest 服务地址（例如 http://localhost:17890）
SKILLHUB_API_KEY - 本地 Claw Skill Nest API Key

典型触发语（本地语义）

列出本地 skill / list local skills
上传本地 skill \x3Cfile> / upload local skill \x3Cfile>
安装本地 skill \x3Cname> / install local skill \x3Cname>
更新本地 skill \x3Cname> / update local skill \x3Cname>
从本地 claw-skill-nest 安装 \x3Cname>
从本地 claw-skill-nest 更新 \x3Cname>
把这个 skill 上传到本地 claw-skill-nest
上传到虾滑
把这个技能传到虾滑
从虾滑安装 \x3Cname>
从虾滑更新 \x3Cname>
虾滑里有什么 skill
upload to Xiahua
install \x3Cname> from Xiahua
update \x3Cname> from Xiahua
what skills are in Xiahua

非适用场景

clawhub.com 上的搜索、安装、发布（请使用 ClawHub 相关能力）
远程公共仓库同步

脚本入口（跨平台 TypeScript）

通用脚本：scripts/manage_local_claw_skill_nest.ts
运行方式（任意平台）：
- npx tsx scripts/manage_local_claw_skill_nest.ts 列出
- npx tsx scripts/manage_local_claw_skill_nest.ts 安装 \x3Cname>
- npx tsx scripts/manage_local_claw_skill_nest.ts 更新 \x3Cname>
- npx tsx scripts/manage_local_claw_skill_nest.ts 上传 \x3C本地文件路径> [skill名称] [描述]

安装位置

Skills 将安装到 ~/.openclaw/workspace/skills/\x3Cname>

安全使用建议

This skill appears to do what it says: manage a local/private Claw Skill Nest. Before installing, consider: (1) set SKILLHUB_URL and SKILLHUB_API_KEY to your local/private endpoint and avoid using any API key that is used for other services; the script has a default URL and API key which you should override in real use; (2) the script writes into ~/.openclaw/workspace/skills and uses temporary directories — ensure you are comfortable with skill archives being saved there; (3) uploading a local .skill/.zip will transmit its contents to the configured SKILLHUB_URL — do not upload files containing secrets you don't intend to share; (4) the script may spawn 'unzip' or PowerShell Expand-Archive to extract archives — ensure those system commands are trustworthy on your host; (5) if you want maximum assurance, review the included TypeScript file yourself or run it in an isolated environment (e.g., container) before granting access to production data or production API keys.

功能分析

Type: OpenClaw Skill Name: claw-skill-nest-client Version: 1.0.3 The skill acts as a client for a local/private skill repository, providing functionality to download, upload, and install code packages. It uses 'child_process.spawn' to execute shell commands (powershell and unzip) for archive extraction in 'scripts/manage_local_claw_skill_nest.ts', which contains a potential command injection vulnerability if a remote server returns a malicious skill name. While the behavior is consistent with the stated purpose of managing local skills, the combination of network fetching and shell execution of downloaded artifacts represents a significant security risk.

能力评估

✓ Purpose & Capability

Name, description, SKILL.md and the included script all implement a local/private Claw Skill Nest client (list/upload/install/update). The declared SKILL.md environment variables (SKILLHUB_URL, SKILLHUB_API_KEY), download/upload endpoints, and install path (~/.openclaw/workspace/skills) align with this purpose.

✓ Instruction Scope

Runtime instructions and the script are scoped to managing skills: calling the local service API, downloading/uploading skill archives, extracting or saving them, and writing into the skills directory. The script only reads the specified local file for upload, temp files during download, and writes into the skills directory; it does not attempt to read unrelated system files or other credentials.

✓ Install Mechanism

There is no install spec (instruction-only with a single TypeScript script). No remote install or archive download is performed during install time by the platform; the script itself performs network actions at runtime which is expected for this client. This is low-risk and proportionate.

ℹ Credentials

The SKILL.md documents SKILLHUB_URL and SKILLHUB_API_KEY which are appropriate for this client. However, registry metadata listed no required env vars while the SKILL.md and script do use those env vars (with defaults). The script also provides a hardcoded default URL and API key ('http://localhost:17890' and 'claw-skill-nest-secret-key'), which is convenient for local use but should be noted before deploying in environments where API keys are sensitive.

✓ Persistence & Privilege

always is false and the skill does not request elevated or global agent privileges. It writes skill files into ~/.openclaw/workspace/skills (consistent with its purpose) and may invoke unzip/PowerShell to extract archives — expected for installing skill packages.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install claw-skill-nest-client
安装完成后，直接呼叫该 Skill 的名称或使用 /claw-skill-nest-client 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.3

Add Xiahua alias to improve search and trigger matching.

v1.0.2

Add 虾滑/Xiashua semantic keywords for discovery

v1.0.1

Rename installer to client; clarify SKILL.md metadata and scope.

元数据

Slug claw-skill-nest-client

版本 1.0.3

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 3

常见问题