← 返回 Skills 市场
64
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install skillwiki
功能描述
Analyze and review ClawHub skills. IMPORTANT: Always run scripts/fetch_skill.py first to download skill data as JSON from ClawHub — NEVER read the target ski...
安全使用建议
This skill is designed to fetch and analyze remote skill packages, which is coherent, but it forces you to rely on a remote copy from a non-obvious host. Before installing or running it: (1) verify the CLAWHUB_DOWNLOAD_URL points to an official ClawHub API/domain you trust (edit skillwiki.ini if necessary); (2) inspect scripts/fetch_skill.py yourself to confirm no unexpected network endpoints or exfiltration logic; (3) consider running the script in an isolated environment (no sensitive creds, limited network access) and review the downloaded JSON before asking the agent to analyze it; (4) prefer reading the local skill files directly if you suspect the remote source is untrusted. If you cannot confirm the download host is legitimate, treat the skill as untrusted.
功能分析
Type: OpenClaw Skill
Name: skillwiki
Version: 1.0.0
The skill is a security auditing tool designed to analyze other OpenClaw skills. It includes a Python script (`scripts/fetch_skill.py`) that fetches skill packages from a remote repository (ClawHub), extracts metadata, and scans for potential risks like undeclared environment variables and hardcoded URLs. The instructions in `SKILL.md` are explicitly defensive, directing the AI agent to avoid direct interaction with untrusted local files and instead use the provided script to parse data into a safe JSON format for analysis.
能力评估
Purpose & Capability
Skill name and SKILL.md describe fetching and analyzing ClawHub skills; included scripts (fetch_skill.py) implement downloading, extracting, and summarizing a skill into JSON — this is coherent with the purpose. However, the bundled config points to a non-obvious host (https://wry-manatee-359.convex.site) rather than a clearly identified official ClawHub domain, which is unexpected for a 'ClawHub' fetcher.
Instruction Scope
SKILL.md mandates always running scripts/fetch_skill.py and explicitly forbids reading the target skill's local files, directing analysis to the remotely downloaded JSON. That forces reliance on remote data instead of local artifacts and increases risk that the agent will analyze an attacker-controlled package. The instructions also tell the agent to change the local config via --config, which will modify skillwiki.ini.
Install Mechanism
No install spec (instruction-only) — low install-time risk. Runtime behavior, however, performs network downloads and zip extraction (fetch_skill.py uses urllib.request and zipfile). The default download URL in the included config is an unusual third-party host (convex.site), which is not a well-known or obviously official release host.
Credentials
The skill does not request credentials or declare required environment variables. The fetch script scans other skills for env var usage but does not itself require secrets. It will, however, write/update skillwiki.ini (SKILLWIKI_LANG) when asked to change language preference.
Persistence & Privilege
always:false (no forced always-on). The script may modify its own configuration file in the skill's parent directory but does not request elevated system-wide privileges. No evidence it modifies other skills or global agent settings.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skillwiki - 安装完成后，直接呼叫该 Skill 的名称或使用
/skillwiki触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
skillwiki 1.0.0 – Initial Release
- Introduces a skill review tool focused on safe and accurate analysis of ClawHub skills.
- Enforces use of scripts/fetch_skill.py to fetch and extract skill metadata as JSON—never reads skill files or SKILL.md directly.
- Provides clear workflow and usage instructions for analyzing, comparing, and understanding skills before install.
- Adds security guidelines, evaluation criteria for different skill types, and recommendations to ensure thorough and responsible reviews.
- Supports language preference setting for analysis reports.
元数据
常见问题
SkillWiki 是什么？
Analyze and review ClawHub skills. IMPORTANT: Always run scripts/fetch_skill.py first to download skill data as JSON from ClawHub — NEVER read the target ski... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 64 次。
如何安装 SkillWiki？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skillwiki」即可一键安装，无需额外配置。
SkillWiki 是免费的吗？
是的，SkillWiki 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
SkillWiki 支持哪些平台？
SkillWiki 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 SkillWiki？
由 skinapi（@skinapi2025）开发并维护，当前版本 v1.0.0。
推荐 Skills