← 返回 Skills 市场
Persona Spawn
作者
Decentraliser🌵
· GitHub ↗
· v1.2.0
· MIT-0
253
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install persona-spawn
功能描述
Spawn subagents with personas from a local workspace library or the Emblem persona marketplace. Use when a task needs a different voice, expertise, or operat...
安全使用建议
This skill appears to do what it says: manage local personas, fetch public personas from a GitHub-hosted marketplace, assemble persona prompts, and spawn subagents. Before installing, consider: (1) personas/config.json can list shared context files; if those paths point to sensitive files (or are absolute paths), the skill will read and inject their contents into the spawned agent prompt — which may be sent to an external model provider, so avoid pointing config to secrets or private system files; (2) the marketplace importer fetches content from GitHub (raw.githubusercontent.com and a GitHub archive) — review any imported persona contents before trusting them; (3) the bundle includes example personas referencing a copyrighted character (The Mandalorian) — check licensing/policy if that matters for your org; (4) the skill writes into your workspace (personas/ and index.json), so review or sandbox those changes if you need strict file isolation. If you want to reduce risk, keep personas/config.json minimal, avoid absolute paths, and review imported persona files before using them.
功能分析
Type: OpenClaw Skill
Name: persona-spawn
Version: 1.2.0
The skill contains a significant Local File Inclusion (LFI) vulnerability in `scripts/build-persona-prompt.py`, which reads and injects the full content of any file path specified in `personas/config.json` into the AI's prompt. While intended for 'org context,' this allows for the potential exfiltration of sensitive files (e.g., SSH keys or credentials) if the configuration is manipulated. Additionally, `scripts/import-persona.sh` downloads and extracts remote assets from a third-party GitHub repository (decentraliser/personas) without any integrity verification or checksums, posing a supply chain risk.
能力评估
Purpose & Capability
Name/description match the delivered assets: scripts to ensure a local persona library, import personas from a public marketplace, build a deterministic persona prompt, and spawn subagents. No extra credentials or unrelated binaries are requested.
Instruction Scope
SKILL.md and scripts only reference persona files and shared org context files. One notable behavior: build-persona-prompt loads files listed in personas/config.json and will resolve absolute paths if present — meaning the skill can read any file path referenced in that config and include it in the assembled prompt. This is consistent with the feature (injecting shared org context) but is a data-exposure risk if config.json points at sensitive files.
Install Mechanism
No install spec (instruction-only), and included scripts use curl to fetch personas from raw.githubusercontent.com / github.com archives — well-known hosts. No downloads from weird or shortener URLs and no extract-from-arbitrary-URLs beyond the GitHub archive.
Credentials
The skill requires no environment variables or external credentials. Network access is used for optional marketplace imports (public GitHub raw URLs) and is reasonable for the described capability.
Persistence & Privilege
always is false. The skill writes to <workspace>/personas/ and creates a personas/config.json when bootstrapping starter personas — this is appropriate for its function. It does not request system-wide privileges or modify other skills.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install persona-spawn - 安装完成后，直接呼叫该 Skill 的名称或使用
/persona-spawn触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.2.0
Add persona override directive, shared context_files support, deterministic prompt builder, starter bootstrap, and improved persona import flow.
v1.1.0
Improve install UX: auto-bootstrap starter personas on first use, add bulk import/archive mode, add --no-index batching, self-locating scripts, and clean up marketplace schema docs.
v1.0.0
Initial public release: persona-based subagent spawning, marketplace import, starter personas, and local index tooling.
元数据
常见问题
Persona Spawn 是什么？
Spawn subagents with personas from a local workspace library or the Emblem persona marketplace. Use when a task needs a different voice, expertise, or operat... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 253 次。
如何安装 Persona Spawn？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install persona-spawn」即可一键安装，无需额外配置。
Persona Spawn 是免费的吗？
是的，Persona Spawn 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Persona Spawn 支持哪些平台？
Persona Spawn 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Persona Spawn？
由 Decentraliser🌵（@decentraliser）开发并维护，当前版本 v1.2.0。
推荐 Skills