skill-optimizer

Analyzes AI conversation logs to evaluate skill performance and generate optimization suggestions. Use when user mentions "优化技能", "迭代技能", "skill optimization...

This skill can analyze logs and will offer concrete edits — including directly editing another skill's SKILL.md after you confirm. Before installing or invoking it: 1) Be sure you trust the skill author and back up any skills you permit it to modify (export or copy SKILL.md). 2) Never provide paths to system or sensitive files; only point it at the specific skill files you want changed. 3) Require the agent to show a diff and ask for an additional explicit approval step before any write is performed. 4) Prefer running it in a sandbox or repository copy rather than letting it edit production skill files. 5) If you need assurance, ask the author to declare required config paths/permissions and to include a dry-run mode that outputs changes without writing them.

Type: OpenClaw Skill Name: skill-optimizer Version: 1.0.0 The `SKILL.md` file contains instructions that pose significant security risks. Specifically, Phase 1 instructs the AI agent to "读取文件" (read file) based on user-provided paths, creating a Local File Inclusion (LFI) vulnerability. Furthermore, Phase 4 instructs the agent to "直接修改目标技能的 SKILL.md" (directly modify the target skill's SKILL.md), granting arbitrary file write capabilities to skill definitions. These explicit instructions to perform file system operations based on user input represent a direct prompt injection surface, allowing potential attackers to read sensitive files and inject malicious instructions into other skills for persistence or privilege escalation.