← 返回 Skills 市场
324
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install done
功能描述
自动解压并安装技能压缩包到 WSL2 和 Windows 桌面。支持 zip 格式。
使用说明 (SKILL.md)
Done - 自动技能安装器
功能描述
一键自动解压技能压缩包并安装到：
- WSL2 系统：
~/.openclaw/workspace/skills/ - Windows 桌面：
C:\Users\yanha\Desktop\skills\
使用方法
方式一：直接提供压缩包路径
帮我 Done 一下 "C:\Users\yanha\Downloads\skill-1.0.0.zip"
或
done "C:\Users\yanha\Downloads\skill-1.0.0.zip"
方式二：使用 done/done 关键词
帮我 done "C:\Users\yanha\Downloads\skill-1.0.0.zip"
工作流程
- 检测路径格式：支持 Windows 和 Linux 路径
- 解压压缩包：自动识别 ZIP 格式
- 提取技能信息：读取 SKILL.md 和 _meta.json
- 安装到 WSL2：复制到
~/.openclaw/workspace/skills/\x3Cskill-name>/ - 备份到 Windows：复制到桌面 skills 文件夹
- 清理临时文件：自动清理解压目录
- 报告结果：显示技能信息和安装位置
支持的路径格式
Windows 路径
C:\Users\yanha\Downloads\skill-1.0.0.zip
C:/Users/yanha/Downloads/skill-1.0.0.zip
Linux 路径
/home/yanha/Downloads/skill-1.0.0.zip
~/Downloads/skill-1.0.0.zip
WSL 挂载路径
/mnt/c/Users/yanha/Downloads/skill-1.0.0.zip
技能信息提取
自动从 SKILL.md 提取：
- 技能名称：name 字段
- 描述：description 字段
- 主页：homepage 字段（可选）
输出示例
✓ 正在处理压缩包: C:\Users\yanha\Downloads\summarize-1.0.0.zip
✓ 已解压
✓ 技能名称: Summarize
✓ 描述: Fast CLI to summarize URLs, local files, and YouTube links
📦 安装位置:
WSL2: ~/.openclaw/workspace/skills/summarize
Windows: C:\Users\yanha\Desktop\skills\summarize
✓ 安装完成！
错误处理
- ❌ 文件不存在 → 提示检查路径
- ❌ 不是 ZIP 文件 → 提示格式错误
- ❌ 缺少 SKILL.md → 提示无效技能包
- ❌ 复制失败 → 显示详细错误信息
注意事项
- 路径中的空格：请使用引号包裹路径
- 压缩包格式：目前只支持 ZIP 格式
- 技能命名：自动从 SKILL.md 的 name 字段提取
- 覆盖安装：如果技能已存在，会自动覆盖
快捷命令
所有以下写法都会触发：
Done "路径"done "路径"帮我 done "路径"帮我 Done "路径"Done 一下 "路径"done 一下 "路径"
自动化特性
- ✅ 自动转换 Windows 路径到 WSL 路径
- ✅ 自动检测技能名称
- ✅ 自动清理临时文件
- ✅ 双向备份（WSL2 + Windows）
- ✅ 详细的进度反馈
版本: 1.0.0 作者: OpenClaw Assistant
安全使用建议
This installer largely does what it says, but you should not run it blindly. Specific concerns:
- The code uses zipfile.extractall without sanitizing filenames; a crafted ZIP can include absolute paths or ../ segments and overwrite files outside the temp directory. This can enable file overwrite or deletion on your system.
- The installer uses a hardcoded Windows path (/mnt/c/Users/yanha/...), so it may operate on the wrong user's Desktop or fail on your machine.
- The SKILL.md's name field is used directly as the destination folder name; a malicious name could cause unexpected paths.
- The installer deletes existing skill folders (shutil.rmtree) before copying — you can lose data if the target is misresolved.
What to do before installing:
- Inspect the ZIP contents manually (or list its entries) before running the installer.
- Run the installer in a safe/isolated environment (non-privileged account, VM) or after backing up your Desktop and skills directories.
- If you plan to use this tool regularly, modify the code to: validate/sanitize ZIP member paths, refuse absolute or parent-traversal paths, canonicalize and constrain destination paths to a safe base directory, and replace the hardcoded Windows username with a dynamic lookup or configuration option.
- Do not run this with elevated privileges. If the author can provide a version that safely validates archives and uses configurable target paths, re-evaluate for lower risk.
功能分析
Type: OpenClaw Skill
Name: done
Version: 1.0.0
The skill bundle contains a critical path traversal vulnerability in `install.py`. The `skill_name` is extracted from the `SKILL.md` file within a user-provided ZIP without sanitization, allowing an attacker to potentially delete or overwrite arbitrary directories (e.g., `~/.ssh`) via `shutil.rmtree` and `shutil.copytree`. Additionally, the script contains hardcoded Windows paths for a specific user profile (`yanha`), which is highly irregular for a general-purpose tool and suggests it was not designed with multi-user security in mind.
能力评估
Purpose & Capability
Name and description match the code: it extracts a ZIP and copies its contents into a WSL skills directory and a Windows Desktop 'skills' folder. However the code uses a hardcoded Windows user path (/mnt/c/Users/yanha/...), which is not explained by the metadata and is not appropriate for a general-purpose tool. This is inconsistent (works only for a specific username) and may lead to unexpected behavior on other machines.
Instruction Scope
SKILL.md and install.py instruct the agent to read the provided ZIP, parse SKILL.md from inside it, and copy files into user locations (WSL ~/.openclaw/... and Windows Desktop). The installer deletes existing target directories and copies files recursively. The code uses zipfile.extractall without sanitizing archive entries, and it uses the extracted SKILL.md's name field as the destination folder name — both allow path traversal or malicious archive contents to overwrite or create files outside the intended directories.
Install Mechanism
No external install steps or network downloads are used; the skill is instruction/code-only and runs locally. There is no download-from-URL or third-party package installation, which reduces supply-chain risk.
Credentials
The skill declares no required environment variables or credentials, which is consistent, but the code hardcodes Windows paths for a specific user ('yanha') and also assumes WSL mount points. That is a disproportionate and brittle assumption and may cause files to be written to unintended locations or fail silently if paths don't exist.
Persistence & Privilege
The skill is not force-installed (always:false) and does not modify other skill configs, but it performs destructive filesystem operations: removing existing skill directories (shutil.rmtree) and copying archives into user directories. Combined with the unsafe extraction and use of SKILL.md name as a path, this grants it a high potential to overwrite/delete user files on both WSL and the Windows desktop.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install done - 安装完成后，直接呼叫该 Skill 的名称或使用
/done触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of the Done skill—automatic skill package installer for WSL2 and Windows desktop.
- Installs ZIP-packaged skills in one step, supporting both Windows and Linux/WSL2 paths.
- Automatically extracts, reads SKILL.md, and copies skills to WSL2 and Windows desktop folders.
- Supports common command phrases such as Done, done, 帮我 done, and variations.
- Provides detailed installation progress and error handling.
- Cleans up temporary files and overwrites existing skills if needed.
元数据
常见问题
done 是什么？
自动解压并安装技能压缩包到 WSL2 和 Windows 桌面。支持 zip 格式。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 324 次。
如何安装 done？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install done」即可一键安装，无需额外配置。
done 是免费的吗？
是的，done 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
done 支持哪些平台？
done 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 done？
由 Aetik（@aetik-yue）开发并维护，当前版本 v1.0.0。
推荐 Skills