Wanng Ide Auto Skill Hunter

Proactively discovers, ranks, and installs high-value ClawHub skills by mining unresolved user needs and agent context. Use when new tasks are unsolved, when...

This skill is coherent with its stated goal but has meaningful risks you should accept consciously before enabling automatic runs. Key actions you can take: 1) Start with --dry-run and SKILL_HUNTER_NO_REPORT=1 to preview candidates without installs or external reports. 2) Limit --max-install to 1 and run it manually at first. 3) Review the hunt.js code paths that perform git clones/scaffolds and the downstream SKILL.md/index.js of any candidate before allowing them to install/run. 4) Restrict execution to an isolated/sandboxed environment or a non-production workspace, and avoid pointing it at agent session directories containing sensitive PII until you audit it. 5) If you plan to enable scheduling, require human review/approval before installs or route reports to an internal audit-only endpoint. If you want lower risk, prefer manual discovery workflows or a read-only preview mode only.

Type: OpenClaw Skill Name: wanng-ide-auto-skill-hunter Version: 1.0.0 The skill implements an autonomous 'discover-and-install' loop that mines sensitive session logs and user profiles to identify capability gaps, then fetches and executes third-party code from external endpoints (clawhub.com). While this behavior is aligned with its stated purpose of agent evolution, the script (src/hunt.js) automatically executes untrusted remote payloads using execSync for 'self-testing' and suggests persistence via cron jobs, creating a significant Remote Code Execution (RCE) and supply chain risk. It also processes private conversation data to generate search queries, which could lead to unintentional data exposure.