← 返回 Skills 市场
rxdaozhang

Clawmart Install

作者 rxdaozhang · GitHub ↗ · v1.2.3 · MIT-0
cross-platform ⚠ suspicious
147
总下载
0
收藏
1
当前安装
6
版本数
在 OpenClaw 中安装
/install clawmart-install
功能描述
Search and install an OpenClaw configuration pack from ClawMart
使用说明 (SKILL.md)

ClawMart Install Skill

You are helping the user find and install an OpenClaw configuration pack from ClawMart. Follow these steps exactly and in order.

Configuration

  • ClawMart API base URL: https://clawmart-gray.vercel.app
  • Config file: ~/.openclaw/clawmart-config.json
  • Install target: ~/.openclaw/workspace/ (non-skill files)
  • Skills target: ~/.openclaw/workspace/skills/ (skill folders)
  • Backup directory: ~/.openclaw/backups/

Step 1: Check API Token

Read ~/.openclaw/clawmart-config.json. If the file does not exist or token is empty:

Tell the user:

You need a ClawMart API Token to download packs. Please visit https://clawmart-gray.vercel.app/dashboard/tokens to generate one, then paste it here.

Once the user provides a token (format: cm_ followed by hex characters), save it:

{
  "token": "\x3Cuser_provided_token>",
  "base_url": "https://clawmart-gray.vercel.app"
}

Write this to ~/.openclaw/clawmart-config.json.


Step 2: Determine Search Query

Extract the pack name from the user's message. If the user said something like "install Deep Research Analyst", the search query is "Deep Research Analyst".

If no specific name was mentioned, ask:

Which pack would you like to install? Enter a search keyword.


Step 3: Search ClawMart

Call:

GET {base_url}/api/packs/search?q={query}&limit=8

Parse the packs array from the response. If empty, tell the user:

No packs found matching "{query}". Please try different keywords.

Then stop.

If results exist, display them as a numbered list:

Found the following packs:

1. \x3CPack Title A>
   By: @username · ⭐ 4.8 · ↓ 1.2K
   Contains: SOUL, AGENTS, MEMORY, SKILLS ×3
   "Pack description..."

2. \x3CPack Title B>
   By: @username · ⭐ 4.5 · ↓ 856
   Contains: SOUL, AGENTS
   "Pack description..."

Select a pack to install (enter number, or 0 to cancel):

Wait for user input.


Step 4: Show Pack Details

Use the data already returned from the search response (no extra API call needed). Display:

Pack Details:
─────────────────────────────
Title:       \x3Cpack.title>
By:          @\x3Cpack.creator.username>
Rating:      ⭐ \x3Cpack.avg_rating> · ↓ \x3Cpack.download_count>

Description:
\x3Cpack.description>
─────────────────────────────

Confirm install? (y/n)

Note the id from the search result — it is used in Step 6 to call the download endpoint.


Step 5: Check for Conflicts

Before downloading, check what files exist in ~/.openclaw/workspace/ and ~/.openclaw/skills/.

Compare with the pack's file list. If any files would be overwritten, list them:

The following files will be overwritten (originals will be backed up to ~/.openclaw/backups/2026-03-28-143022/):

  · claude.soul.md  (existing file will be backed up)
  · research.agents.md  (new file)

Continue? (y/n)

Step 6: Download Pack

Call the download endpoint:

POST {base_url}/api/packs/{id}/download
Authorization: Bearer {token}
Content-Type: application/json

The response is JSON — no signed URL, no ZIP file:

{
  "version": "1.0.0",
  "files": [
    { "name": "SOUL.md",               "type": "SOUL",   "size": 4200, "content": "..." },
    { "name": "skills/my.skill.md",    "type": "SKILLS", "size": 980,  "content": "..." },
    { "name": "skills-manifest.json",  "type": "OTHER",  "size": 180,  "content": "{\"clawhub_skills\":[...]}" }
  ]
}

Store this response in memory for Step 8.


Step 7: Backup Conflicting Files

If any conflicting files were found in Step 5:

  1. Create backup directory: ~/.openclaw/backups/{YYYY-MM-DD-HHmmss}/
  2. Copy each conflicting file to the backup directory
  3. Tell the user: Backed up {n} file(s) to ~/.openclaw/backups/{timestamp}/

Step 8: Install Files

Write each entry from the files array in the download response:

  • type == "SKILLS" → write content to ~/.openclaw/workspace/skills/{name without skills/ prefix}/SKILL.md
  • name == "skills-manifest.json"do not write to disk; parse the JSON and display the clawhub_skills list (see below)
  • All other files → write content to ~/.openclaw/workspace/{name}

Create directories if they don't exist.

External skills handling: If the response includes a skills-manifest.json file, parse its clawhub_skills array and inform the user:

This pack references external skills that are not installed automatically:

  - \x3Cskill-slug-1>  (v1.0.0)
  - \x3Cskill-slug-2>  (v2.0.0)

To install them, run the appropriate plugin install command for each source.

Step 9: Confirm Installation

Tell the user:

Installation complete!

Installed to ~/.openclaw/workspace/:
  · claude.soul.md
  · research.agents.md
  · deep_analysis.boot.md
  · memory_projects.json

Installed to ~/.openclaw/skills/:
  · 3 skill files

Backup location: ~/.openclaw/backups/2026-03-28-143022/ (copy files back to restore)

Restart OpenClaw to load the new configuration.

Notes

  • Pack detail page: {base_url}/packs/{id}
  • If token authentication fails (401), direct the user to regenerate at {base_url}/dashboard/tokens
  • Local skill files are installed to ~/.openclaw/workspace/skills/ and visible after installation
  • External skills listed in skills-manifest.json must be installed separately via their own source
  • No restart required — OpenClaw loads new configuration on the next conversation
安全使用建议
This skill behaves like an installer: it will ask you for a ClawMart API token and then download JSON describing files to write into ~/.openclaw/workspace/ and workspace/skills/. Before proceeding: 1) Verify the ClawMart endpoint (https://clawmart-gray.vercel.app) is an official/trusted URL for the packs you expect; the skill's registry entry has no source or homepage. 2) Inspect search results and the downloaded pack JSON (files array and skills-manifest) before confirming installation — review every file the pack will write, especially any SKILL.md files, because installed skills can extend agent behavior. 3) Back up your ~/.openclaw/ workspace manually (the skill does create backups, but keep an external copy). 4) Consider creating a limited-scope token (if supported) or using a throwaway account when testing. 5) If you cannot verify the upstream service or inspect the pack contents safely, avoid providing your token and do not install the pack.
功能分析
Type: OpenClaw Skill Name: clawmart-install Version: 1.2.3 The skill functions as a package manager that downloads and installs configuration packs from a remote endpoint (clawmart-gray.vercel.app). It manages API tokens in '~/.openclaw/clawmart-config.json' and writes arbitrary file content to the user's workspace and skills directories. While the behavior is consistent with its stated purpose and includes a backup mechanism, the ability to fetch and install remote code (SKILL.md files) and the potential for path traversal during the installation process in SKILL.md Step 8 represent significant security risks.
能力评估
Purpose & Capability
The name/description and instructions are coherent: the skill searches a ClawMart API, downloads a pack, backs up conflicts, and writes files into ~/.openclaw/workspace and workspace/skills. However the declared API base (https://clawmart-gray.vercel.app) and missing source/homepage raise provenance questions — the host appears to be a third-party Vercel URL rather than a clearly identified official ClawMart domain.
Instruction Scope
Instructions stick to the installer's scope (read token config, query search endpoint, download pack JSON, back up and write files). A notable capability: remote pack contents are written directly into your workspace and skills directories (including SKILL.md files), which is expected for an installer but also means remote content can add executable skills to your agent. The skill does not instruct reading unrelated system paths or environment variables.
Install Mechanism
This is instruction-only with no install spec or external binary downloads, so nothing new is installed on disk by the installer itself prior to user approval.
Credentials
No environment variables or external credentials are requested, which is proportional. The skill does ask the user for a ClawMart API token and instructs saving it in plaintext at ~/.openclaw/clawmart-config.json — storing a bearer token locally is expected for this use but carries confidentiality risk; the token scope/permissions are not described.
Persistence & Privilege
always is false and the skill does not declare elevated platform privileges. It does write and overwrite files under ~/.openclaw/, and will install arbitrary skill files returned by the service; this is normal for a pack installer but increases the blast radius if the upstream source is untrusted.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clawmart-install
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clawmart-install 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.2.3
- Changed all references to pack "slug" to "id" for API calls and URLs. - Updated instructions in Steps 4, 6, and Notes to use pack `id` instead of `slug` when downloading or displaying pack details. - No functional logic changes; documentation only.
v1.2.2
- Skills are now installed to `~/.openclaw/workspace/skills/` as skill folders (not `~/.openclaw/skills/`). - Skill files are written as `SKILL.md` inside their respective skill folder. - Updated installation and backup instructions to match new directory structure. - Step 4 updated: pack details use only search response data, no extra API call. - Clarifies file locations and behavior throughout for consistency.
v1.2.1
- No functional or user-facing changes; SKILL.md template/example pack names and details updated for generality. - Replaced sample pack titles, authors, and content with generic placeholders in step-by-step instructions. - All process steps and API interactions remain unchanged.
v1.2.0
- Changed download and installation process: replaces signed URL/ZIP download with direct API JSON response containing all files. - Installation now writes file contents directly from API response, eliminating the need to unzip files. - The `skills-manifest.json` file is parsed from memory, not written to disk, and external skill list is displayed accordingly. - Updated examples and instructions throughout to match new API response format and simpler file handling.
v1.0.1
**Minor update and clarity improvements for pack installation** - Simplified and clarified user instructions and process flow throughout. - Added explicit triggers for easier activation (e.g., "install from clawmart"). - Separated handling of local skill files and external skills; now clearly informs user that external skills are not installed automatically. - Adjusted workspace/skills file routing to use `.skill.md` pattern for skills; improved backup and conflict checks. - All user-facing messages are now in English for consistency.
v1.0.0
Initial release of clawmart-install skill. - Enables searching and installing OpenClaw configuration packs from the ClawMart marketplace. - Guides users through token setup, searching, pack selection, conflict checking, automatic backup, and installation. - Installs packs into appropriate OpenClaw directories and applies origin markers for external skills. - Provides clear prompts and messages throughout the process, supporting both English and Chinese. - Automated conflict detection and backup of overwritten files.
元数据
Slug clawmart-install
版本 1.2.3
许可证 MIT-0
累计安装 1
当前安装数 1
历史版本数 6
常见问题

Clawmart Install 是什么?

Search and install an OpenClaw configuration pack from ClawMart. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 147 次。

如何安装 Clawmart Install?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawmart-install」即可一键安装,无需额外配置。

Clawmart Install 是免费的吗?

是的,Clawmart Install 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

Clawmart Install 支持哪些平台?

Clawmart Install 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Clawmart Install?

由 rxdaozhang(@rxdaozhang)开发并维护,当前版本 v1.2.3。

💬 留言讨论