← 返回 Skills 市场
Skill Factory
作者
mwangxiang
· GitHub ↗
· v1.0.0
545
总下载
1
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install wx-skill-factory
功能描述
Skill工厂，AI作为规划层循环迭代生产新Skill（需求对齐→选档→设计→生成→测试→对比→迭代→交付），支持手动/半自动/全自动三档模式
安全使用建议
Before installing or enabling this skill, consider the following:
- It will ask you to configure third‑party AI endpoints and API keys (the tech-library.md template). Do NOT paste secrets into public repos; prefer platform secret storage or environment variables where possible.
- In full-automatic mode the skill will autonomously call external AI services and may send user or generated data to those endpoints. If that data is sensitive, use manual or semi-automatic mode instead.
- The skill metadata declares no required credentials, but the runtime explicitly expects API keys in config files — this mismatch means the skill might access secrets that are not declared in metadata. Confirm where and how you must provide keys and review those files before enabling.
- Review and sanitize any test inputs used during the skill's automated testing phase; limit iteration counts and monitor logs for unexpected network activity.
- If you plan to use external AIs, verify the endpoints and owners (do not use unknown personal servers or shorteners), and consider restricting the skill to a sandboxed account with minimal privileges.
If you want, provide the locations where you would store API credentials (env vars / secret manager) or ask for recommended configuration edits to avoid storing secrets in repo files — I can suggest safer configuration patterns.
功能分析
Type: OpenClaw Skill
Name: wx-skill-factory
Version: 1.0.0
The bundle implements a 'Skill Factory' designed to recursively generate, test, and execute new AI skills, which is a high-risk architectural pattern. Specifically, SKILL.md instructs the agent to execute generated content during a 'Test Run' phase (Step 6), creating a potential vector for arbitrary command execution if the generation process is subverted by malicious input. Furthermore, call-guide.md and tech-library.md provide templates for managing and using sensitive API keys via shell-based curl commands, which increases the potential impact of a prompt injection attack, despite the author's inclusion of security warnings.
能力评估
Purpose & Capability
The skill is a meta-skill that designs and tests other skills and explicitly supports calling external AI services as an execution layer — that capability is coherent with the description. However, it expects API access to third‑party AIs (per tech-library.md / call-guide.md) even though the skill metadata declares no required credentials or primaryEnv, which is an inconsistency.
Instruction Scope
SKILL.md instructs the agent to read included configuration templates (tech-library.md, call-guide.md), to actually invoke external AI endpoints (curl examples), and to perform full automated test runs that will send test inputs to third‑party APIs. Those are legitimate for this skill, but they give the agent scope to transmit user-provided and generated content to arbitrary external endpoints and to perform repeated autonomous calls in full-automatic mode.
Install Mechanism
This is instruction-only with no install spec and no code files — lowest install risk. Nothing in the package writes binaries or downloads remote archives.
Credentials
The runtime docs require API credentials/endpoints (tech-library.md) and instruct storing them in a config file, but the registry metadata lists no required environment variables or primary credential. Asking users to place secrets in repo/config files is poor practice and the skill does not declare or gate access to those secrets, creating a proportionality and transparency mismatch.
Persistence & Privilege
always:false and no install hooks are present. The skill does not request permanent platform-level presence or claim to modify other skills' configs. Autonomous invocation is allowed (platform default); that is expected but increases blast radius when combined with the other concerns.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install wx-skill-factory - 安装完成后，直接呼叫该 Skill 的名称或使用
/wx-skill-factory触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Initial public release of skill-factory (v1.0.0)
- Enables AI-driven iterative creation, improvement, and modularization of new Skills, supporting manual, semi-automatic, and fully-automatic production modes
- Includes a detailed, multi-step factory process (需求对齐→选档→设计→生成→测试→对比→迭代→交付) with role division between user, planning AI, and optional plug-in execution AIs
- Introduces scoring, quality gate, and iterative delivery mechanisms for output assessment and refinement
- Provides guidelines for template/benchmark selection, sub-skill generation, and fallback AI handling for robust execution
- Comprehensive documentation and process transparency, including reference documents for configuration and integration
元数据
常见问题
Skill Factory 是什么？
Skill工厂，AI作为规划层循环迭代生产新Skill（需求对齐→选档→设计→生成→测试→对比→迭代→交付），支持手动/半自动/全自动三档模式. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 545 次。
如何安装 Skill Factory？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install wx-skill-factory」即可一键安装，无需额外配置。
Skill Factory 是免费的吗？
是的，Skill Factory 完全免费（开源免费），可自由下载、安装和使用。
Skill Factory 支持哪些平台？
Skill Factory 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill Factory？
由 mwangxiang（@mwangxiang）开发并维护，当前版本 v1.0.0。
推荐 Skills