Teach your OpenClaw agent new tricks by creating custom skills. Use when you want your agent to do something it can't do yet — like "read my Google Calendar"...
Security Analysis
high confidenceThis is a coherent, local skill-generator: it runs locally, doesn't itself ask for secrets or download remote code, and only suggests credentials that are appropriate for the kinds of skills it can create.
Name and description match the behavior found in handler.ts and SKILL.md: the package is a local skill creator that generates skill templates (Google Calendar, Slack, CSV) and instructions. There are no unrelated environment variables, binaries, or install steps requested by the generator itself.
The SKILL.md and handler.ts limit actions to generating skill files and guidance. The generator does not attempt to read arbitrary system files, exfiltrate data, or call external endpoints itself. It does include templates that instruct the user how to configure credentials for external services (which is expected for those integrations).
No install spec is provided (instruction-only), and the included handler.ts is local code. There are no downloads, URL-based installs, or archive extraction steps in the skill bundle.
The generator declares no required environment variables. Templates reference service-specific credentials (e.g., GOOGLE_CALENDAR_CREDENTIALS, SLACK_BOT_TOKEN) only in contexts where external integrations would legitimately need them. No unrelated secrets or broad system credentials are requested.
The skill is not marked always:true and does not request elevated or persistent system-wide privileges. It does not modify other skills' configuration or agent settings beyond producing guidance for the user to add skill files and environment variables.
Guidance
This generator appears to be what it claims: a local tool that writes new SKILL.md files and example code. However, the skills it creates (e.g., Google Calendar reader or Slack messenger) will legitimately require API credentials or service-account files. Before using any generated skill, review the generated SKILL.md and code: 1) only provide API keys or JSON credential files if you trust the integration and understand its scope; 2) store credentials securely (avoid world-readable files and prefer least-privilege tokens); 3) check the generated code for any endpoints or behaviors you do not expect; and 4) test new skills in a limited or non-production environment first. If you want higher assurance, ask the author for provenance or signed releases, or run the generated code through your organization's code review process before enabling it in agents that have access to sensitive data.
Latest Release
v1.0.2
- No functional or documentation changes in this release. - Version updated to 1.0.2 with no changes to files or content.
More by @kennyzir
Published by @kennyzir on ClawHub
