skillscope

AI Agent Skill decision engine. Use when users need to find, evaluate, or install skills — recommends the best skill for any task with quality/safety scoring...

This skill is coherent with its purpose (a third‑party skill-recommendation API), but it relies on an external site (skillscope.cn) that can return install commands and file URLs. Before installing or executing anything the skill suggests, inspect the API response and any install command or package name manually. Prefer official sources (clawhub install) over third‑party pip mirrors. If you must use it: 1) do not run pip installs or shell install commands returned by the API without review; 2) verify package provenance (PyPI / GitHub releases) and read the package code if unsure; 3) restrict autonomous invocation or require user confirmation for any install action; 4) consider network restrictions or allowlisting the external domain; and 5) if you need higher rate limits, obtain an API key only after validating the operator and privacy/security policy. If you are not comfortable reviewing installs, treat the skill as untrusted.

Type: OpenClaw Skill Name: skillscope Version: 1.0.1 The skill functions as a recommendation engine that directs the AI agent to fetch and execute installation commands from an external API (skillscope.cn). While this aligns with its stated purpose of skill discovery, the pattern of providing executable strings from a third-party endpoint creates a significant risk of Remote Code Execution (RCE) if the backend returns malicious payloads. Additionally, it promotes a custom CLI tool via 'pip install skillscope' as a mirror, which increases the supply chain attack surface.