OpenClaw-Skill-Creator

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize a...

This package looks like a legitimate skill-creation toolkit but it has undeclared, high-impact behaviors: several scripts call the local 'claude' CLI and will transmit skill content, prompts, and evaluation data to external Claude/Anthropic services using whatever session credentials are present. The package also may write temporary files outside the skill folder (e.g., ~/.claude or .claude/commands). Before installing or running anything: - Inspect the code first (read the Python scripts mentioned: run_eval.py, improve_description.py, run_loop.py). Look for subprocess calls and network operations. - Do not run these scripts with your real credentials. If you must test, run them in an isolated VM/container with networking disabled or with a mocked 'claude' binary that does not forward data. - Backup or isolate your workspace (especially any existing .claude directory) before running. - Prefer the packaged alternative mentioned in CHANGELOG (skill-creator-guide) if you want a documentation-only, OpenClaw-native option. - Ask the publisher/maintainer to update registry metadata to explicitly list required binaries (claude CLI), Python/runtime dependencies, exact file-system side effects, and an option to run in offline/dry-run mode. If those changes are made (and an offline/mock mode is provided), the risk assessment could move toward benign; until then treat this skill as suspicious.