OpenClaw Doc Finder

OpenClaw 文档检索专家。当用户询问 OpenClaw 配置、维护、故障排除、通道接入、技能安装、模型配置等问题时使用。支持快速定位官方文档、给出精确 URL 和关键命令。高价值触发场景包括：（1）配置 gateway、channels、plugins；（2）排查连接/认证/权限问题；（3）安装/管理技能（...

This skill appears to be what it says: a local doc indexer and retriever for OpenClaw. Before installing, note these practical points: (1) it will read local OpenClaw docs if they exist under your home (script looks in ~/.npm-global/.../openclaw/docs) to build the index; (2) at runtime it may run remote fetches (curl or agent web fetch) and executes a small inline Python snippet to extract text — this is normal for HTML->plaintext extraction but does execute code locally; (3) it writes caches and a doc-lookups.md log inside the skill folder (references/fetched/, references/doc-lookups.md, references/doc-index.md, VERSION). If you are uncomfortable with persistent local logs of queries, review or remove references/doc-lookups.md after use or modify the skill before enabling automatic version-sync. If you require stronger assurances, ask the maintainer to: (a) avoid scanning arbitrary home paths (or make the openclaw docs path configurable), (b) make document-fetch actions explicit and user-triggered, and (c) provide an opt-out for local query logging.

Type: OpenClaw Skill Name: openclaw-doc-finder Version: 1.2.0 The skill bundle provides legitimate documentation retrieval functionality but includes high-risk execution patterns that increase the attack surface. Specifically, SKILL.md instructs the AI agent to use a 'curl | python3' shell command as a fallback for fetching remote content, which could be leveraged for remote code execution (RCE) if the URL parameters are manipulated via prompt injection. Additionally, the scripts/sync-version.py script performs filesystem read/write operations and accesses global npm directories to synchronize versions, representing broad permissions for a documentation tool.