← 返回 Skills 市场
fff
作者
sundayslove
· GitHub ↗
· v2.0.0
· MIT-0
121
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install testskillhhh
功能描述
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express...
安全使用建议
This skill is coherent for finding skills, but take precautions before using it: 1) Verify the source/author — the embedded _meta.json owner/slug/version differ from the registry metadata shown; confirm you trust the publisher. 2) Never run 'npx skills add ... -g -y' as-is — avoid global installs and skip-confirm flags; require that installs be confirmed and inspected first. 3) Prefer installing locally or in a sandbox, and inspect the package/repo before running. 4) If you allow the agent to act autonomously, disable non-interactive installs or require explicit user confirmation for every install. 5) If in doubt, ask the skill to show the exact repo URL and a link to its source on GitHub/skills.sh and review the code manually before proceeding.
功能分析
Type: OpenClaw Skill
Name: testskillhhh
Version: 2.0.0
The skill 'testskillhhh' (Find Skills) provides instructions for an AI agent to search for and install third-party packages using the 'npx skills' CLI. While this aligns with its stated purpose, the SKILL.md file explicitly directs the agent to use the '-y' and '-g' flags (e.g., 'npx skills add <package> -g -y'), which bypasses user confirmation and installs code globally. This creates a high-risk path for the automated execution of remote code from unverified sources like GitHub or skills.sh without manual oversight.
能力评估
Purpose & Capability
The SKILL.md describes a find/install helper and the suggested commands (npx skills find/add) are consistent with that purpose. However, the registry metadata shown to you (owner, slug, version) does not match the _meta.json embedded in the package (different ownerId, slug, version). That discrepancy could indicate a copy/paste, republishing under a different identity, or packaging mistake and warrants verification before trust.
Instruction Scope
Instructions are narrowly scoped to searching and installing skills using the Skills CLI (npx skills). They do not request unrelated files or environment variables. Concern: the README explicitly recommends running installs with -g and -y (global + skip confirmations), which encourages non-interactive global installation of third-party code — this expands the impact of any mistaken or malicious install.
Install Mechanism
No install spec in the package itself (instruction-only). The runtime instructions rely on 'npx skills' which will download and run packages from npm/GitHub. That is an expected mechanism for a skills-discovery helper, but it inherently allows arbitrary remote code execution when used. Users should treat 'npx skills add' as privileged and review sources before running.
Credentials
The skill does not request environment variables, credentials, or config paths. That is proportionate to its described role. Still, the recommended global installations affect user environment and should be treated cautiously.
Persistence & Privilege
always:false (good), but model invocation is allowed (default). Combined with instructions that recommend non-interactive, global installs, an agent that invokes this skill autonomously could install and execute other skills without explicit human confirmation. If you allow autonomous installs, this increases blast radius.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install testskillhhh - 安装完成后，直接呼叫该 Skill 的名称或使用
/testskillhhh触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v2.0.0
Initial release of the "find-skills" capability.
- Helps users discover and install agent skills for specialized tasks.
- Guides users on when and how to search for skills using the Skills CLI.
- Provides step-by-step instructions and example queries for finding relevant skills.
- Explains how to install, update, and check for skill updates.
- Includes strategies for effective skill searches and suggestions for next steps if no skill is found.
v1.0.0
test-skill 1.0.0 – Initial release
- Introduces a comprehensive framework for performance benchmarking, context continuity, and edge-case validation.
- Provides modules for load testing, shared-context evaluation, and capability boundary analysis.
- Includes a structured validation matrix detailing objectives and success criteria for each test type.
- Outlines an execution protocol for initiating test sequences with customizable parameters.
元数据
常见问题
fff 是什么？
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 121 次。
如何安装 fff？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install testskillhhh」即可一键安装，无需额外配置。
fff 是免费的吗？
是的，fff 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
fff 支持哪些平台？
fff 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 fff？
由 sundayslove（@sundayslove）开发并维护，当前版本 v2.0.0。
推荐 Skills