Find Skills

安全扫描

Security ScanVirusTotalVirusTotalBenignView report →OpenClawOpenClawSuspiciousmedium confidenceThe skill's description matches its instructions (it uses the Skills CLI to find and install skills), but the runtime guidance encourages executing third‑party code via npx and installing packages globally with -y (skipping prompts), which raises safety concerns that the metadata does not address.Details ▾✓Purpose & CapabilityThe name/description (find and install skills) align with the SKILL.md: it documents using the 'npx skills' CLI and skills.sh to search and add skills. Nothing requested in metadata (no creds, no binaries) conflicts with that purpose.ℹInstruction ScopeInstructions are focused on searching and installing skills via 'npx skills'. They do not request reading local files or unrelated environment variables. However, they explicitly suggest running 'npx skills add <pkg> -g -y' (global install, auto-confirm) which instructs the agent to fetch and run remote code without interactive confirmation — a behavior that broadens runtime authority and risk.ℹInstall MechanismThere is no install spec in the skill bundle (instruction-only), but the runtime workflow depends on npx (npm) to fetch/execute packages from the public registry and GitHub. Using npx/npmpackages means arbitrary remote code will be executed at runtime if the agent follows the instructions — this is expected for a finder/installer but is a higher-risk operation than purely local actions.✓CredentialsThe skill requests no environment variables, credentials, or config paths. That is proportionate to a discovery/install helper.!Persistence & PrivilegeThe SKILL.md encourages global installs (-g) and auto-confirmation (-y). While the skill metadata does not force always:true, following the instructions would persist third‑party code system‑wide and could be performed without explicit user re-confirmation if the agent is allowed to run shell commands. This combination increases the blast radius of any malicious third‑party skill installed.What to consider before installingThis skill is coherent for finding and adding skills, but exercising caution is important before allowing it to install anything.…

文件内容摘录

Find Skills This skill helps you discover and install skills from the open agent skills ecosystem. When to Use This Skill Use this skill when the user: Asks "how do I do X" where X might be a common task with an existing skill Says "find a skill for X" or "is there a skill for X" Asks "can you do X" where X is a specialized capability Expresses interest in extending agent capabilities Wants to search for tools, templates, or workflows Mentions they wish they had help with a specific domain (design, testing, deployment, etc.) What is the Skills CLI? The Skills CLI (npx skills) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools. Key commands: npx skills find [query] - Search for skills interactively or by keyword npx skills add <package> - Install a skill from GitHub or other sources npx skills check - Check for skill updates npx skills update - Update all installed skills Browse skills at: https://skills.sh/ How to Help Users Find Skills Step 1: Understand What They Need When a user asks for help with something, identify: The domain (e.g., React, testing, design, deployment) The specific task (e.g., writing tests, creating animations, reviewing PRs) Whether this is a common enough task that a skill likely exists Step 2: Search for Skills Run the find command with a relevant query: npx skills find [query] For example: User asks "how do I make my React app faster?" → npx skills find react performance User asks "can you help me with PR reviews?" → npx skills find pr review User asks "I need to create a changelog" → npx skills find changelog The command will return results like: Install with npx skills add <owner/repo@skill> vercel-labs/agent-skills@vercel-react-best-practices └ https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices Step 3: Present Options to the User When you find relevant skills, present them to the user with: The skill name and what it does The install command they can run A link to learn more at skills.sh Example response: I found a skill that might help! The "vercel-react-best-practices" skill provides React and Next.js performance optimization guidelines from Vercel Engineering. To install it: npx skills add vercel-labs/agent-skills@vercel-react-best-practices Learn more: https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices Step 4: Offer to Install If the user wants to proceed, you can install the skill for them: npx skills add <owner/repo@skill> -g -y The -g flag installs globally (user…

评论