← 返回 Skills 市场
chenjunyeee

clawgo-clone

作者 chenjunyeee · GitHub ↗ · v1.0.1 · MIT-0
cross-platform ⚠ suspicious
169
总下载
1
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install clawgo-clone
功能描述
Download a zip from clawgo.me by key, back up current workspace Markdown, then copy zip contents into the local OpenClaw workspace. Use when the user gives a...
使用说明 (SKILL.md)

ClawGo workspace sync skill

Download a zip from clawgo.me, back up existing files, and copy Markdown from the archive into the local OpenClaw workspace.

Service limits

  • Base URL: https://clawgo.me
  • Key: 12 alphanumeric characters (server normalizes to uppercase)
  • Only .zip payloads; require status: ready before download
  • Target folder: ~/.openclaw/workspace/

Workflow

Step 1 — Check key readiness

curl -s https://clawgo.me/api/clones/{key}/availability
  • available: true and status: ready → continue
  • status: pending → stop with error: "No zip uploaded for this key yet"
  • Missing key (404) → stop with error: "Key not found"

Step 2 — Download zip to a temp path

curl -s -L -o /tmp/clone-{key}.zip \
  https://clawgo.me/api/clones/{key}/download

Verify: file size must be greater than zero.

Step 3 — Extract and inspect

mkdir -p /tmp/clone-{key}
unzip -o /tmp/clone-{key}.zip -d /tmp/clone-{key}/

Run these safety checks after extraction. If anything looks wrong, warn the user clearly and ask whether to proceed:

  • List archive contents
  • Require at least one of: SOUL.md, AGENTS.md, TOOLS.md
  • If empty or none of the expected Markdown files → stop with error

Step 4 — Back up current workspace files

BACKUP_DIR="/tmp/backup-before-clone-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_DIR"
WORKSPACE="$HOME/.openclaw/workspace"

for f in SOUL.md AGENTS.md TOOLS.md IDENTITY.md USER.md HEARTBEAT.md; do
    [ -f "$WORKSPACE/$f" ] && cp "$WORKSPACE/$f" "$BACKUP_DIR/$f"
done

Tell the user the backup path so they can roll back manually if needed.

Step 5 — Write archive files into the workspace

WORKSPACE="$HOME/.openclaw/workspace"
SRC="/tmp/clone-{key}"

for f in SOUL.md AGENTS.md TOOLS.md IDENTITY.md USER.md HEARTBEAT.md; do
    [ -f "$SRC/$f" ] && cp "$SRC/$f" "$WORKSPACE/$f"
done

Only files present in the zip are copied; local files missing from the zip are left unchanged (not removed).

Step 6 — Report results

Tell the user:

  • Files successfully written from the zip
  • Files skipped because they were absent from the zip
  • Backup directory path
  • Suggestion: run /reset to restart the session so new workspace content loads

Workspace file reference

File Role
SOUL.md Primary identity, reasoning style, behavioral guardrails
AGENTS.md Session bootstrap, tool policy, hard limits
TOOLS.md Local tooling notes and proxy routing
IDENTITY.md Display name, role, emoji metadata
USER.md User profile and session context
HEARTBEAT.md Scheduled task notes

Errors

Situation Action
status: pending Stop; ask the user to upload a zip first
Key missing (404) Stop; invalid key
No expected Markdown in zip Stop; archive content does not match expectations
Downloaded file size is 0 Stop; retry or report failure
Copy failed (permissions, etc.) Report error; backup remains available
安全使用建议
This skill does what it says, but take precautions before running it: only use it if you trust clawgo.me and the key's source. Before copying files into your workspace, inspect the zip listing for any path components (../) or absolute paths and for symlinks. Prefer a safer extraction strategy (for example: unzip into a temp dir, reject files whose paths contain '/' or start with '/', reject symlinks, and verify each extracted file is a regular file whose resolved path is inside the temp directory). Consider verifying an integrity checksum or signature for the zip if available. Keep the created backup directory so you can roll back. If you want, modify the script to explicitly reject symlinks (e.g., test -L) or to copy only files whose canonical path begins with the expected temp directory to avoid zip-slip or symlink-based local file reads.
功能分析
Type: OpenClaw Skill Name: clawgo-clone Version: 1.0.1 The skill downloads a ZIP archive from an external domain (clawgo.me) and overwrites core OpenClaw configuration files (SOUL.md, AGENTS.md, TOOLS.md) that govern the agent's identity and security policies. While the workflow includes a backup mechanism and requires user confirmation, the process allows for remote modification of the agent's behavioral logic, which could be exploited to bypass guardrails or establish persistence via malicious configuration files.
能力评估
Purpose & Capability
Name/description match the instructions: the skill downloads a zip from clawgo.me, backs up ~/.openclaw/workspace Markdown files, and copies specific Markdown files from the archive into the workspace. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
Instructions perform exactly the claimed actions but omit safe-extraction and integrity checks. They call curl and unzip on a network-provided archive and then cp selected filenames into the workspace. Missing safeguards: no checksum or signature verification, no explicit checks for path traversal (filenames containing '../' or absolute paths), and no defenses against archive-created symlinks that could cause the cp step to read arbitrary local files. The workflow does list/inspect archive contents and requires expected Markdown filenames, but does not mandate rejecting archives with suspicious paths or symlinks.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by an installer. Runtime uses standard system tools (curl, unzip, cp) which are expected for the task.
Credentials
No environment variables, credentials, or config paths are requested. The externally fetched zip is the only external dependency (clawgo.me). This is proportionate to the stated purpose.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system privileges or modify other skills. It operates only when invoked by the user (or agent) and writes only to the user's ~/.openclaw/workspace and /tmp for backups; this matches its purpose.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clawgo-clone
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clawgo-clone 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.1
## clawgo-clone v1.0.1 - Added metadata file `_meta.json` - No functional changes to skill logic or workflow - Documentation now includes an English version (SKILL.md updated from Chinese to English)
v1.0.0
clawgo-clone 1.0.0 – 首发版本 - 实现通过 clawgo.me 提供的 12 位 key 下载配置 zip,覆盖本地 OpenClaw 核心配置文件 - 自动备份当前工作区配置,支持手动恢复 - 检查并验证 zip 包内容安全,关键文件缺失时中止并提示 - 精确错误处理,如 key 不可用、zip 包未准备好、内容不符等均明确告知 - 仅覆盖 zip 内存在的配置文件,自动汇报覆盖和跳过项
元数据
Slug clawgo-clone
版本 1.0.1
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 2
常见问题

clawgo-clone 是什么?

Download a zip from clawgo.me by key, back up current workspace Markdown, then copy zip contents into the local OpenClaw workspace. Use when the user gives a... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 169 次。

如何安装 clawgo-clone?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawgo-clone」即可一键安装,无需额外配置。

clawgo-clone 是免费的吗?

是的,clawgo-clone 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

clawgo-clone 支持哪些平台?

clawgo-clone 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 clawgo-clone?

由 chenjunyeee(@chenjunyeee)开发并维护,当前版本 v1.0.1。

💬 留言讨论