Skeall Skill Builder

Agent Skills (SKILL.md) builder, auditor, and improver for cross-platform LLM agents. Use for "skeall", "build a skill", "create skill", "improve skill", "au...

This skill appears to be what it claims: a local SKILL.md builder/auditor. Before installing or granting it autonomous access, note that its healthcheck mode will read local skill directories and platform config files (e.g., ~/.openclaw/, ~/.claude/, ~/.agents/) and may scan session logs and make HTTP requests to any URLs found in skills. Those behaviors are expected for an auditor but can reveal sensitive local metadata. Recommendations: (1) run its scan/healthcheck manually first in a safe directory to review outputs, (2) avoid pointing it at directories containing sensitive logs or secrets, (3) review any proposed automatic fixes before applying them (backup configs first), and (4) if you will let it run autonomously, restrict scope or monitor its activity until you’re comfortable.

Type: OpenClaw Skill Name: skeall Version: 1.0.0 The skill 'skeall' is designed to build, audit, and improve other Agent Skills. While its stated purpose is benign and even security-focused (it includes checks for hardcoded credentials, XML injection, and other anti-patterns in *other* skills), it possesses inherently high-risk capabilities. These include broad file system access (reading, writing, modifying skill files and platform configurations), environment variable inspection, and network calls (HTTP HEAD requests for URL validation). These capabilities, though necessary for its function, could be exploited through prompt injection against the agent or other vulnerabilities in the agent's execution environment, potentially leading to unauthorized file modification, data exfiltration, or network scanning. There is no evidence of intentional malicious behavior within the skill itself, but its powerful capabilities warrant a 'suspicious' classification.