Skill Publish Adapter Real

技能发布适配器：自动绕过ClawHub所有已知问题，将发布成功率从15%提升到70%。用户无需查看ClawHub源码即可成功发布技能。

This skill downloads and runs shell scripts from a remote GitHub raw URL and performs filesystem and publishing actions — that can execute arbitrary code. Before installing: 1) Inspect the referenced install.sh and skill-publish-adapter.sh in the remote repository (raw URL) and verify their contents and author. 2) Verify the repository owner and commit history (who maintains it). 3) Prefer a bundled package or published release with checksums/signatures rather than executing raw scripts. 4) Run the tool in an isolated environment (container, VM) or sandbox first, and avoid running it on systems with sensitive credentials or keys. 5) Ask the publisher to declare required env vars/credentials and to include the scripts in the package or a verifiable release. If you can provide the contents of the remote scripts (install.sh / skill-publish-adapter.sh), I can review them and reduce uncertainty.

Type: OpenClaw Skill Name: skill-publish-adapter-real Version: 2.0.0 The skill bundle exhibits several red flags, including a significant discrepancy between the package name in package.json (@clawhub/skill-validator) and the skill name in SKILL.md (skill-publish-adapter), as well as inconsistent GitHub handles for the author. The SKILL.md file contains instructions for the AI agent to download and execute external shell scripts via curl from a third-party repository (github.com/puppetcat-fire), which is a high-risk pattern for remote code execution. While the tool claims to 'bypass' platform bugs to improve publishing success rates, this framing combined with the external script fetching and missing local source code (install.sh) warrants a suspicious classification.