Skillcraft

Design and build OpenClaw skills. Use when asked to "make/build/craft a skill", extract ad-hoc functionality into a skill, or package scripts/instructions for reuse. Covers OpenClaw-specific integration (tool calling, memory, message routing, cron, canvas, nodes) and ClawHub publishing.

This skill is an authoring guide and is internally consistent. Because it instructs agents to read other skills and workspace files, review any workspace content and other skills for sensitive data before using it to auto-extract or package code. The skill itself asks for no credentials and performs no installs, but be cautious if you follow its guidance to add state files or to request environment variables later when authoring new skills — never hardcode secrets into SKILL.md or published skill files, and review any resulting SKILL.md or install steps before publishing or installing. If you do not want agents to autonomously create/publish skills, consider controlling invocation or review outputs manually.

Type: OpenClaw Skill Name: skillcraft Version: 1.0.0 The 'skillcraft' skill is designed to guide the AI agent in creating other OpenClaw skills. While its instructions are aligned with this stated purpose, it details how to leverage several high-risk capabilities. Specifically, SKILL.md instructs the agent on how to define `metadata.openclaw.install` for new skills, which includes options for downloading and executing remote binaries (e.g., `kind: download`, `url: https://...`). Additionally, the skill guides the agent to use powerful OpenClaw tools like `exec` (for running arbitrary commands) and `sessions_spawn` (for creating subagents) when building new skills. These capabilities, while presented as legitimate features for skill development, represent significant security risks if misused, leading to a 'suspicious' classification due to risky capabilities without clear malicious intent from the skill itself.