Skill Forge 2026 03 21

Skillsmith-JOJO — 完美主义技能工坊，JOJO's Workshop 出品。 专为完美主义者设计的 AI 技能开发工具，提供从零到发布的完整工作流。 使用场景： - 用户说"创建一个新技能"、"帮我做一个技能" - 用户说"优化这个技能"、"改进 SKILL.md" - 用户说"审计技能"、"检查...

This appears to be a legitimate skill-development toolkit. Before installing/using it: 1) ensure your environment has git if you plan to use the Git templates (git is referenced in git-assistant but not declared at top-level); 2) inspect any skill you test with these tools to ensure it does not contain secrets (security-check.py flags patterns like .ssh or .aws but only scans files — it does not exfiltrate data); 3) review the use of 'clawhub publish' and the clawhub CLI before publishing (it may require separate authentication); and 4) if you will run these scripts on directories containing sensitive material, run them in a safe environment or sandbox first. If you want higher assurance, ask the author to add git to the top-level required binaries and provide a short README describing published-package dependencies and expected runtime behaviors.

Type: OpenClaw Skill Name: skillsmith-jojo Version: 1.0.0 The skillsmith-jojo bundle is a developer utility designed to assist in creating, testing, and auditing AI skills. It includes legitimate tools such as a security scanner (security-check.py) that looks for dangerous patterns, a token usage analyzer (token-analyzer.py), and Git automation scripts (git-branch.py, git-commit.py) that use safe subprocess calls with input sanitization. The instructions in SKILL.md and the provided templates are consistent with the stated purpose of providing a structured development workflow, and no evidence of malicious intent or data exfiltration was found.