Skill Creator Enhanced (Vault Awareness)

Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.

This package looks like a legitimate skill-authoring toolkit: packaging, initialization, and validation scripts are appropriate for the stated purpose. However, the submission included truncated file contents (notably parts of SKILL.md and init_skill.py were cut off), so I couldn't fully review all code. Before installing or granting it to an agent: 1) Inspect the full init_skill.py and any truncated files for any network calls, subprocess.exec/child_process usage, or code that reads arbitrary filesystem paths (especially home directories, /etc, or other skills' folders). 2) Search the scripts for any hardcoded secrets or endpoints. 3) Run the scripts in a sandboxed environment to confirm behavior (packaging/validation only). 4) If you plan to let the agent invoke this autonomously, consider limiting its access and reviewing telemetry/logging to ensure it cannot exfiltrate secrets. If you can provide the full untruncated sources I can raise confidence or flag specific issues found there.

Type: OpenClaw Skill Name: skill-creator-vault-enhancement Version: 1.0.0 This OpenClaw AgentSkills bundle is designed for creating, validating, and packaging other skills. The `SKILL.md` acts as a comprehensive guide for skill developers, emphasizing secure practices like using a vault-based credential system and explicitly warning against hardcoding API keys. The Python scripts (`init_skill.py`, `package_skill.py`, `quick_validate.py`) implement these guidelines, including robust security features such as skipping symlinks and preventing path traversal during packaging, and detecting hardcoded API keys during validation. The presence of unit tests specifically for these security features further reinforces a strong commitment to secure skill development. There is no evidence of malicious intent, data exfiltration, or prompt injection against the executing agent; instead, the instructions and code aim to prevent such vulnerabilities in skills being created.