skill-hr

Use when the user starts a new multi-step task, asks to pick/install/manage skills, tune skill performance, or fire/remove a skill after failure. Acts as HR...

This bundle appears to do what it says: orchestrate JD intake, match installed skills, recruit, hand off, and maintain a project-local registry and incidents directory. Still, take these precautions before installing or running anything: - Inspect the included Python scripts (scripts/run_matching_benchmark_llm.py and scripts/validate_registry.py) for any remote network calls, hidden endpoints, or commands that would send data out. Do not run them until you've reviewed them. - The benchmark script can call an 'OpenAI-compatible' API; only provide API keys if you trust the code and understand what data will be sent. Prefer running static validators (validate_registry.py) in read-only mode first. - The skill will enumerate skill directories (workspace roots and user-level skill folders like ~/.openclaw/skills or ~/.claude/skills) and read SKILL.md files. That is expected, but be aware it will access multiple local files; if there are private or sensitive files mixed into those locations, review what will be read. - The SKILL.md includes good safety guidance (vetoes against blind `curl | sh`, explicit user consent before installs, no silent deletes). Keep those gates in place: require explicit user confirmation before cloning or executing third-party installers. If you want, I can: (a) summarize the contents of any specific script for you, (b) scan the scripts for outgoing network calls and obvious exfil patterns, or (c) suggest a minimal, read-only checklist to run the package safely.