Skill Distill

当需要把多个功能重叠的 skill 合并为一个蒸馏版 skill 时使用。 不适用于从 skills 提取 rules（rules extraction is a separate capability from ECC's rules-distill skill, not part of this repo）或...

This skill mostly does what it says (merging skills), but its runtime steps tell the agent to execute local Python validation scripts and to read/write under ~/.claude even though the package metadata declares no config paths or credentials. Before installing or using it: (1) verify the referenced improvement-* scripts exist in ~/.claude and inspect them so you trust what they execute; (2) back up any source skill directories you might allow the tool to modify or delete; (3) insist on explicit, interactive confirmation for any delete/replace actions and review a dry-run diff of proposed changes; (4) if you prefer safer testing, run the distillation process in a sandbox or on copies of skills rather than on your primary skills directory. If you cannot inspect the local scripts or prefer not to grant execution rights, treat this skill as higher-risk and avoid running its Phase 4 automated validation steps.

Type: OpenClaw Skill Name: skill-distill Version: 1.0.1 The skill is designed to consolidate overlapping skill bundles through a multi-phase workflow. It is classified as suspicious because Phase 4 in SKILL.md instructs the agent to execute shell commands (python3) using local script paths and user-provided variables (e.g., {new-skill-path}). This introduces a potential shell injection vulnerability if the agent does not properly sanitize inputs before execution. While the functionality is aligned with the stated purpose of quality validation, the reliance on executing external scripts in the ~/.claude/skills/ directory constitutes a high-risk capability.