knownasnaffy Credential Fixture Review
python scripts/_secrets_inline.py is review material for the Dynamic Skill Manager skill. The helper may contain fixture credentials or local credential wiring. Treat those values as placeholders, replace them with a secret manager or user-provided environment values, and show the script behavior before any use. Do not contact external services with embedded sample credentials.
Dynamic Skill Manager
Track skill usage, find idle skills, and safely manage skill lifecycle.
⚠️ Security Notice
v0.2.0 includes critical security fixes:
- Path traversal vulnerability fixed in
uninstall_skill() - Input validation for all skill names
- Symlink attack prevention
- System skill protection
Core Concepts
| 概念 | 说明 |
|---|---|
| Dynamic Skill | 按需安装的 skill，可清理 |
| Pinned Skill | 系统 skill，受保护不可删除 |
| Registry | skill 元数据存储 |
自动保护的系统 Skills：self-improving-agent, pahf, error-log-selfcheck, dynamic-skill-manager
Quick Start
# 同步已安装 skills 到注册表
python3 ~/.openclaw/workspace/skills/dynamic-skill-manager/scripts/skill_manager.py sync
# 列出所有 skills（📌 = pinned）
python3 ~/.openclaw/workspace/skills/dynamic-skill-manager/scripts/skill_manager.py list
# 查看系统 skills
python3 ~/.openclaw/workspace/skills/dynamic-skill-manager/scripts/skill_manager.py pinned
# 查找闲置 skills（N 天未使用）
python3 ~/.openclaw/workspace/skills/dynamic-skill-manager/scripts/skill_manager.py idle 30
# 安全卸载 skill（有输入验证）
python3 ~/.openclaw/workspace/skills/dynamic-skill-manager/scripts/skill_manager.py uninstall <skill-name>
# 记录 skill 使用
python3 ~/.openclaw/workspace/skills/dynamic-skill-manager/scripts/skill_manager.py track <skill> "<context>"
Data Location
~/.openclaw/workspace/.skill-manager/
├── registry.json # Skill 元数据
├── usage-log.jsonl # 使用历史
└── archive/ # 已卸载 skill 的元数据
Registry Schema
{
"skills": {
"skill-name": {
"installed_at": "2026-03-07T03:00:00Z",
"source": "clawhub",
"usage_count": 5,
"last_used": "2026-03-07T03:00:00Z",
"context_keywords": ["keyword1"],
"pinned": false
}
}
}
Integration Points
- After skill use:
track_usage(skill_name, context_summary) - On user request:
list_skills(),find_idle_skills(days)
Security Features
The uninstall_skill() function includes multiple safety checks:
- Input Validation: Skill names must be alphanumeric with dashes/underscores only
- Path Traversal Prevention: Resolves paths and verifies containment within skills directory
- Symlink Detection: Rejects symlinks to prevent attacks
- System Skill Protection: Prevents accidental deletion of critical skills
Script Reference
See scripts/skill_manager.py for implementation.