← 返回 Skills 市场
99
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install howtoletmyagent-installer
功能描述
Install companion OpenClaw skills from howtoletmyagent.xyz article URLs or skill manifests.
使用说明 (SKILL.md)
Howtoletmyagent Installer
Use this skill when the user wants to install or learn a companion skill from a Howtoletmyagent article.
Accepted inputs:
- An article URL like https://howtoletmyagent.xyz/articles/\x3Cslug>
- A manifest URL like https://howtoletmyagent.xyz/api/skills/\x3Cslug>
- A plain request such as "learn the skill from this page" when the article URL is present in context
Required workflow:
- Verify that the source URL belongs to https://howtoletmyagent.xyz or another explicitly approved preview host.
- Resolve the manifest URL:
- article URL -> /api/skills/\x3Cslug>
- manifest URL -> use it directly
- Fetch the manifest JSON.
- Explain what will be installed and ask for approval before writing files or running install commands.
- If the manifest says the source is
clawhub, prefer the provided install command. - If a ClawHub install is unavailable or fails, create a local workspace skill folder and write the manifest files exactly as provided.
- After install, tell the user to start a new session with
/newor restart the gateway so OpenClaw reloads the skill.
Safety rules:
- Only trust manifests from https://howtoletmyagent.xyz unless the user explicitly approves another domain.
- Never execute arbitrary code from the manifest. This manifest is for skill files, not shell scripts.
- Show the target install path before writing files.
- If a manifest looks malformed or unsafe, stop and explain the issue instead of guessing.
Implementation notes:
- Prefer using browser or web-fetch tools to read the manifest.
- If a CLI install is approved, use the exact command supplied by the manifest.
- If you must install from files, write each file under
skills/\x3Cskill-name>/using the manifestfilesarray.
Success condition:
- The requested companion skill is installed.
- The user gets the exact prompt they can use next to trigger it.
安全使用建议
This installer does what it says (fetch manifests and install skills) but can write files and — if you approve — run commands supplied by a remote manifest. Before approving an install: 1) verify the manifest URL is exactly on https://howtoletmyagent.xyz (or explicitly approve a different domain only if you trust it); 2) request to see the manifest JSON and all files it will write; inspect files for scripts, post-install commands, or encoded payloads; 3) do not approve running a manifest-provided CLI command unless you fully trust the source — prefer a manual, auditable install; 4) consider installing in a sandbox or review checksums/签名 if provided; 5) if unsure, ask the installer to only produce the files (no execution) so you can inspect and manually run safe commands yourself. The SKILL.md contains a contradictory statement about 'never execute arbitrary code' vs 'use exact command supplied' — treat CLI execution as a high-risk action and require explicit, informed consent.
功能分析
Type: OpenClaw Skill
Name: howtoletmyagent-installer
Version: 0.1.0
The skill functions as a remote installer that fetches manifests from 'howtoletmyagent.xyz' and executes commands or writes files to the local system. While SKILL.md includes safety instructions such as domain verification and requiring user approval before execution, the core logic of running arbitrary 'install commands' provided by a remote JSON manifest is a high-risk behavior that could lead to Remote Code Execution (RCE) if the source domain is compromised or serves malicious content.
能力评估
Purpose & Capability
The name and description match the SKILL.md: it fetches manifests from howtoletmyagent.xyz and installs companion skills by writing files under skills/<skill-name> or running a provided CLI install. Requesting no env vars or binaries is proportionate. The ability to write skill files and (with approval) run CLI install commands is expected for an installer, though it increases risk compared with a read-only skill.
Instruction Scope
The instructions require fetching remote manifests and writing files 'exactly as provided' and allow running an exact CLI command from the manifest if the user approves. There is an internal contradiction: the safety rules say 'Never execute arbitrary code from the manifest,' but the implementation notes say 'If a CLI install is approved, use the exact command supplied.' That creates ambiguity about what the agent may run. Writing arbitrary files and then executing a manifest-supplied command (even with user approval) can install malicious code. The SKILL.md does require explicit user approval before writing or running installs, which reduces risk but does not eliminate it.
Install Mechanism
No automated install spec (no downloads, no package installs) is present in the registry metadata — lowest static install risk. However, the runtime behavior explicitly includes writing files to disk (skills/<skill-name>/) and optionally running manifest-supplied CLI commands. Those runtime actions are not captured in the registry install spec and are the primary risk vector; they rely on correct agent behavior and clear user consent.
Credentials
The skill requests no environment variables, credentials, or config paths, which is proportionate to its role as a manifest-driven installer. However, manifest installation may implicitly require network access or credentials for third-party package managers at runtime; the SKILL.md does not request or require those, so the agent should surface any additional credential needs to the user before proceeding.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent platform-wide privileges. It does instruct the agent to write files into the local skills directory, which is expected for an installer and described in the instructions. The skill does not claim to modify other skills or global configuration beyond writing its own installed skill files.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install howtoletmyagent-installer - 安装完成后，直接呼叫该 Skill 的名称或使用
/howtoletmyagent-installer触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.0
Initial bootstrap installer release
元数据
常见问题
Howtoletmyagent Installer 是什么？
Install companion OpenClaw skills from howtoletmyagent.xyz article URLs or skill manifests. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 99 次。
如何安装 Howtoletmyagent Installer？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install howtoletmyagent-installer」即可一键安装，无需额外配置。
Howtoletmyagent Installer 是免费的吗？
是的，Howtoletmyagent Installer 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Howtoletmyagent Installer 支持哪些平台？
Howtoletmyagent Installer 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Howtoletmyagent Installer？
由 Bullkis1（@bullkis1）开发并维护，当前版本 v0.1.0。
推荐 Skills