Scan To Skill

QR-based skill installer for ClawHub. Decodes QR images (Telegram uploads, screenshots, camera captures), extracts a valid skill slug or install command, and...

This skill is internally coherent and enforces a safety gate (it defaults to dry run and requires --confirm). Before you install or use it: 1) ensure the host system has the 'clawhub' CLI installed and you trust installed ClawHub skills (installing any third-party skill can be risky); 2) verify the decoded slug/URL yourself before approving the install (open the skill page on ClawHub as suggested); 3) be aware the script may call 'zbarimg' or require opencv-python — ensure those binaries/packages are from trusted sources; and 4) confirm your agent will never pass the --confirm flag without explicit user consent. The only real issue to fix is metadata: the skill should declare that it relies on the 'clawhub' CLI and optionally 'zbarimg' or opencv so administrators know those dependencies exist.

Type: OpenClaw Skill Name: scan-to-skill Version: 0.2.2 The 'scan-to-skill' bundle is a utility for installing OpenClaw skills via QR code decoding. It features robust safety measures, including strict regex validation for skill slugs, a domain allowlist for URLs, and a mandatory human-in-the-loop confirmation step in SKILL.md before execution. The core script (scripts/install_from_qr.py) uses subprocess safely with argument lists and lacks any indicators of data exfiltration or malicious intent.