← 返回 Skills 市场
rfdiosuao

Skill Combo - 技能组合器

作者 rfdiosuao · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
105
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install skill-combo
功能描述
支持同时启用多个技能协同工作,分工执行并整合结果,实现复杂任务的高效完成与管理。
安全使用建议
This skill's goal (combining installed skills) is reasonable, but two red flags need attention: (1) package metadata references a code entrypoint (src/index.ts) while the package contains only SKILL.md/README and no source files — ask the author whether code was omitted or if this is intentionally instruction-only. (2) The runtime instructions tell the agent to locate, read, import and execute other skills' files — that will run third-party code and can cause side effects or data flows you might not expect. Before installing: verify the upstream repository, prefer installing in a sandboxed/test agent, avoid sending sensitive data to combos until you confirm which skills will run, and request clarification from the author about the missing source files and exact permissions required.
功能分析
Type: OpenClaw Skill Name: skill-combo Version: 1.0.0 The 'Skill Combo' bundle acts as a meta-orchestrator, providing instructions in SKILL.md for the agent to dynamically load, read, and execute multiple other skills based on user-supplied triggers. It describes a workflow involving high-risk operations such as file system access (readFile) and dynamic code execution (import) to facilitate skill synergy. While these capabilities are aligned with the stated purpose of coordinating skills, the logic lacks explicit security boundaries or path sanitization, which could be exploited to access or execute unauthorized files if the agent is manipulated via prompt injection.
能力评估
Purpose & Capability
The declared purpose (multi-skill orchestrator) matches the instructions which load and orchestrate other skills, so the capability requested is plausible — however the package metadata (package.json.skill.json) claims a code entrypoint (main: src/index.ts) but no source files are present in the bundle. That mismatch (metadata implying an implemented module vs. instruction-only SKILL.md) is inconsistent and unexplained.
Instruction Scope
SKILL.md explicitly instructs the agent to locate other skills on disk (findSkillPath), read their source (readFile), extract capabilities, and import/execute them. Those operations involve reading arbitrary skill files and executing their modules at runtime. While that is expected for a combo/orchestrator, it expands the trust boundary: it can execute third-party code and cause side effects beyond the skill's own declared surface.
Install Mechanism
No install spec is provided (instruction-only), which is low risk in itself. However package.json and skill.json indicate a normal code-based skill (main: src/index.ts, build scripts) but no src files are included — this disconnect may be a packaging oversight or indicate incomplete/misleading metadata.
Credentials
The skill declares no required environment variables or config paths, which is appropriate for an instruction-only orchestrator. But the runtime plan to import and execute other skills means that those other skills (not this skill) may access credentials or external endpoints; the aggregator does not declare or control those flows, so install-time lack of requested secrets does not eliminate risk of downstream credential use.
Persistence & Privilege
The skill does not request always:true and is user-invocable only; it does not ask to modify other skills or system config. Autonomous invocation is allowed by platform default — combined with the ability to import/execute other skills this increases the blast radius, but the skill itself does not request persistent or elevated privileges.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install skill-combo
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /skill-combo 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Skill-combo v1.0.0 - Initial release of Skill Combo, a multi-skill coordination engine for combining and orchestrating multiple skills to handle complex tasks. - Supports combination via add (+), comma, and space syntax, as well as multi-language triggers. - Introduces clear multi-step workflows: skill parsing, capability mapping, execution orchestration, and result integration. - Provides layered or fused result templates, detailed division of labor, and execution sequencing or parallelization. - Technical reference and code samples included for skill loading, mapping, orchestration, and integration. - Multiple usage examples and best practices documented.
元数据
Slug skill-combo
版本 1.0.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Skill Combo - 技能组合器 是什么?

支持同时启用多个技能协同工作,分工执行并整合结果,实现复杂任务的高效完成与管理。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 105 次。

如何安装 Skill Combo - 技能组合器?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-combo」即可一键安装,无需额外配置。

Skill Combo - 技能组合器 是免费的吗?

是的,Skill Combo - 技能组合器 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

Skill Combo - 技能组合器 支持哪些平台?

Skill Combo - 技能组合器 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Skill Combo - 技能组合器?

由 rfdiosuao(@rfdiosuao)开发并维护,当前版本 v1.0.0。

💬 留言讨论