发布智能体技能_无限

将本地技能发布到 ClawHub。触发场景：发布技能、上传技能到ClawHub、发布skill、ClawHub发布。

Before installing or running this skill: 1) Confirm you have the exact local toolchain the SKILL.md expects (Node and the xb.cjs at the D:\soft\QClaw\... path, and Python with pyautogui and tkinter). The registry metadata does not declare these dependencies — ask the publisher to add them to metadata. 2) Review the commands in SKILL.md line-by-line and verify the xb.cjs path and any script content on your machine; the SKILL.md uses an absolute path that likely won't match most systems. 3) Understand that the flow automates your OS file dialog and clipboard; only provide a non-sensitive folder path and avoid running this against important system directories. 4) Prefer running in a test account or sandboxed environment first to ensure it behaves as expected. 5) If you don’t trust the source, do not run the pyautogui/PowerShell commands — request the publisher to supply a version that declares required binaries and uses relative/configurable paths.

Type: OpenClaw Skill Name: publish-agent-skill-infinite Version: 1.0.2 The skill bundle automates the publication of local folders to clawhub.ai using high-risk techniques, including PowerShell for file deletion (SKILL.md.bak) and a Python script utilizing 'pyautogui' to take control of the system's keyboard and clipboard (via tkinter) to interact with OS-level file dialogs. While these actions are functionally relevant to the stated purpose of automating a complex upload process, the use of UI automation and direct file system manipulation represents a significant attack surface. The script also relies on specific local paths (D:\soft\QClaw\...) and lacks input sanitization for the folder paths used in command execution.