← 返回 Skills 市场
661
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install script-creator
功能描述
Create and modify scripts in ~/.nanobot/workspace/test with strict Git versioning. Each script lives in its own directory with an isolated git repository. Al...
安全使用建议
Before installing or using this skill, consider: 1) Name mismatch — the skill title suggests GitHub integration but the instructions only perform local git operations; ask the author whether GitHub push/pull and credential use are intended. 2) Missing declarations — the metadata does not list required binaries (git, python, pip) or handle a missing virtualenv; verify those tools and the venv exist or request the skill be updated to create/validate them. 3) Pip installs — the skill will run pip install in the venv and therefore will download and execute third-party package code (PyPI or other indexes); only proceed with packages you trust or require a lockfile/explicit package list. 4) Confirm behavior — the SKILL.md insists on explicit user confirmation before changes; when enabling autonomous invocation for an agent, ensure the agent will not bypass that confirmation. 5) If you need GitHub remote support, ask the developer to add explicit, documented steps for pushing to remotes and to declare the GitHub credential requirements. Overall the skill appears coherent for local script/git management but has enough omissions and a misleading name that you should request clarifications/changes before trusting it with important files.
功能分析
Type: OpenClaw Skill
Name: script-creator
Version: 1.0.0
The skill's stated purpose of managing scripts with Git is benign, and its instructions to the AI agent include strong security constraints. However, the `SKILL.md` instructions implicitly create a critical shell injection vulnerability. The agent is instructed to directly substitute user-provided inputs (e.g., `<script_name>`, `<extension>`, `<package_name>`) into shell commands like `mkdir`, `touch`, `cd`, `pip install`, and `git commit` without any explicit guidance for sanitization. This allows a malicious user to inject arbitrary commands (e.g., `my_script; rm -rf /`) which the agent would then execute, leading to potential remote code execution. Additionally, the instruction to `pip install` user-specified packages introduces a supply chain risk, as malicious packages can execute arbitrary code during installation.
能力评估
Purpose & Capability
The skill name/metadata imply a GitHub companion, but the SKILL.md contains no GitHub remote, authentication, or push/pull steps — it only initializes and uses local git repositories. The metadata lists no required binaries or environment variables, yet the runtime instructions require git, a shell with 'source' available, Python and pip (and an existing virtualenv at ~/.nanobot/workspace/venv). These omissions are incoherent: a script/git manager should declare git/python/pip as required or explain how to proceed if absent, and the 'GitHub' claim should be reconciled with the lack of GitHub actions or credentials.
Instruction Scope
The SKILL.md is explicit and tightly scoped to operations inside ~/.nanobot/workspace/test and to using the specified virtualenv. It mandates user confirmation before creating/modifying files and forbids touching files outside the target directory. However, it instructs performing pip installs into the venv (which will fetch and execute code from package indexes), and it does not specify behavior if the venv or git are missing. These are reasonable for a local development tool but are important security/operational considerations the metadata doesn't surface.
Install Mechanism
This is an instruction-only skill with no install spec and no files to write during install, which minimizes install-time risk. There are no downloads or external install URLs in the package metadata to review.
Credentials
The skill requests no environment variables or credentials, which aligns with a local-only tool. That said, the instructions implicitly require access to git and possibly user git configuration; if a true 'GitHub companion' feature exists, it would require GitHub credentials, but none are requested. The lack of declared required binaries (git, python, pip) is an omission relative to the runtime instructions.
Persistence & Privilege
always is false and the SKILL.md mandates explicit user confirmation before actions, so the skill does not request elevated or permanent platform privileges. Note: the platform default allows autonomous invocation, but the skill's instruction set explicitly requires confirmation before mutating files; this mismatch (platform can run autonomously, skill says 'wait for user') should be considered by the integrator.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install script-creator - 安装完成后，直接呼叫该 Skill 的名称或使用
/script-creator触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Initial release of script-git-manager skill.
- Enforces script creation and modification with strict Git versioning: one script per directory, each with an isolated Git repository.
- Requires and manages all Python dependencies via a dedicated virtual environment at ~/.nanobot/workspace/venv.
- Always presents a detailed plan for user confirmation before any action, and reports progress after every step.
- Prevents unintended file creation, modifications, or state changes; only acts on explicit user instructions.
元数据
常见问题
script creator with github companion 是什么？
Create and modify scripts in ~/.nanobot/workspace/test with strict Git versioning. Each script lives in its own directory with an isolated git repository. Al... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 661 次。
如何安装 script creator with github companion？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install script-creator」即可一键安装，无需额外配置。
script creator with github companion 是免费的吗？
是的，script creator with github companion 完全免费（开源免费），可自由下载、安装和使用。
script creator with github companion 支持哪些平台？
script creator with github companion 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 script creator with github companion？
由 cadot-eu（@cadot-eu）开发并维护，当前版本 v1.0.0。
推荐 Skills