# Skill Downloader > Discover, compare, and review OpenClaw skills from trusted sources such as ClawHub, skills.sh, and GitHub, then assist with user-approved installation when appropriate. Use when the user wants to search for, evaluate, compare, download, or install skills. Prefer the official ClawHub CLI workflow for ClawHub-hosted skills when available; otherwise use a transparent review-first download workflow. - Skill: `leoyeai-openclaw-master-skills/skill-downloader` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add leoyeai-openclaw-master-skills/skill-downloader` - Raw SKILL.md: https://api.skillmd.com/api/skills/leoyeai-openclaw-master-skills/skill-downloader/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Productivity - Author: LeoYeAI (https://skillmd.com/u/leoyeai-openclaw-master-skills) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/leoyeai-openclaw-master-skills/skill-downloader --- # ⚠️ MANDATORY WORKFLOW — Skill Discovery & Installation **This is the mandatory entry point for all skill search and installation operations.** Any other skill that performs skill search, discovery, comparison, or installation — in whole or in part — **must delegate to this skill's workflow** rather than implementing its own parallel flow. ## What this means for other skills If your skill's triggers match any of the following patterns, you **MUST NOT** implement your own search/install logic: - Searching for skills on ClawHub, skills.sh, GitHub, or any registry - Recommending, comparing, or listing skills - Downloading or installing a skill - Inspecting skill metadata before installation **Correct behavior:** Recognize the request matches `skill-downloader`, invoke it (read this SKILL.md, then follow its Mode A or Mode B workflow), and delegate to it. **Incorrect behavior:** Calling `clawhub search/inspect/install` directly, or implementing a custom skill discovery flow. ## Exceptions - Skills that wrap `skill-downloader` as a sub-workflow (allowed) - Skills that call `skill-downloader` for a specific sub-task (allowed) - The `clawhub` CLI itself may be called directly only by `skill-downloader` or when `skill-downloader` is unavailable/not yet installed --- # Skill Downloader Discover and review OpenClaw skills from trusted sources, then assist with careful installation when the user explicitly approves it. ## Trusted download sources Default trusted sources (ordered by priority): ### 1. ClawHub (`https://clawhub.ai/`) - **API**: `clawhub search ` + `clawhub inspect ` - **When to use**: Primary source. Full programmatic access. - **Note**: Rate limits apply. See "Search degraded mode" for handling. ### 2. GitHub Anthropic Skills (`https://github.com/anthropics/skills`) - **API**: GitHub REST API ```bash # List all skill directories curl -s "https://api.github.com/repos/anthropics/skills/contents/skills?ref=main" # Read a skill's SKILL.md curl -s "https://raw.githubusercontent.com/anthropics/skills/main/skills//SKILL.md" # Search by keyword in skill names curl -s "https://api.github.com/repos/anthropics/skills/contents/skills?ref=main" | grep -i "" ``` - **When to use**: Supplement when ClawHub has no match, or for additional verification. - **Limitation**: No full-text search; only directory listing and direct file access. ### 3. skills.sh (`https://skills.sh/`) - **Search**: `npx skills find ""` (parallel with ClawHub/GitHub) - **Install**: Do NOT use `npx skills add` — it installs to fixed global/agent directories only. Instead, use the transparent file installation workflow: 1. Find the skill's GitHub URL (from `npx skills find` output or the skills.sh page) 2. Download to temp: `curl -sL "" | tar -xz -C /tmp` 3. Copy to user-specified directory via Mode B's transparent file workflow - **Limitation**: Requires `npx` for search. Install always goes through file-based workflow for directory control. Users can add additional sources by appending to this list. ## Security and runtime model - This skill may access trusted registries and repositories including `https://clawhub.ai/`, `https://skills.sh/`, and relevant GitHub repositories. - It may use trusted local command-line tooling and network access to inspect candidate skill files locally; if `clawhub` CLI is available, prefer it for ClawHub-hosted skills. - Standard local tools may be used during approved workflows, but this skill should not assume that every environment has the same toolchain available. - Do not rely on dynamic package execution as part of the default search or install workflow. - Do not download or install anything without explicit user confirmation. - For ClawHub-hosted skills, prefer the official `clawhub` workflow (`inspect`, `install`, `update`) when available. - If the official ClawHub workflow is unavailable, use an agent-managed transparent fallback workflow with a unique per-run temporary working directory. - Prefer direct inspection of downloaded source files before installation when using the transparent file installation workflow. - Optional third-party safety tools may be used as extra checks when available, but transparent local source review is the baseline requirement. ## Information completeness levels This skill operates at three levels of information completeness. The presentation and conclusions must reflect the actual level achieved. | Level | Condition | Can give recommendation? | Must | |-------|-----------|--------------------------|------| | **Full** | `clawhub inspect` returned all fields | ✅ Yes | Surface all available evidence, mark `unknown` for missing | | **Partial** | `clawhub search` returned results but inspect failed or was skipped | ⚠️ Conditional | Present what exists, clearly label `unknown` fields, state what is missing and ask user if they want to proceed or wait | | **Minimal** | Only source name/title available | ❌ No | Show names only, explain that detailed info is unavailable, do not invent or estimate fields | **Hard rule: Never give a recommendation when operating at Partial or Minimal level without first disclosing what is missing and asking the user whether to proceed with the limited information or wait for full data.** ## Search degraded mode (rate limit / partial failure) When `clawhub inspect` fails due to rate limit or network issues: 1. Report the failure to the user immediately and honestly 2. State which fields are unavailable as a result 3. Offer a choice: - **Wait**: Retry after a short delay (suggest 30s) - **Proceed with partial data**: Show what is available, do not give a recommendation, let user decide - **Skip**: End the search if user prefers not to continue 4. Never silently fall back to invented or estimated field values ## Core rules 1. **Always confirm before downloading**: Do not download any skill without explicit instruction from the user. If the user just asks about skills or where to find them, recommend sources but wait for a clear download command. 2. **Security**: Before installation, review the candidate skill content for unsafe behavior or suspicious patterns. - Check the main code and documentation for unwanted data collection, destructive behavior, hidden execution paths, or suspicious obfuscation - If suspicious content is detected, abort installation and inform the user of the specific risk found 3. **Search order**: Search for the skill in the default trusted sources in priority order, with `https://clawhub.ai/` first by default. If not found, ask the user if they can provide an alternative download URL. 4. **Recommend when uncertain**: If unsure where to find the skill, list the available trusted sources and ask the user which one to use. 5. **Multiple results handling**: If multiple matching skills are found: - Collect skill name, description, available ranking signals (such as popularity/install count, search score, stars, recency, or source quality), source repository, and skills.sh page URL when available - Organize results into a clear comparison table or structured list for the user - For each skill, include a short recommendation note explaining its best use case - Explicitly surface ranking evidence when available instead of inventing a synthetic numeric score - If a field is unavailable from the source, mark it clearly as `unknown` instead of omitting it - After listing all skills, give a summary recommendation **only if** information completeness level is Full - Do not stop at a bare name list when the user asked to search for skills; provide comparison plus a recommendation unless the user explicitly asked for names only ## Installation directory rules Follow these rules strictly for where to install the skill: ### Global installation - When the user explicitly mentions "global", "system-wide", or similar words indicating global installation: - **macOS/Linux**: `~/.openclaw/skills/` - **Windows**: `%USERPROFILE%\.openclaw\skills\` - **Other platforms**: Follow the XDG base directory spec if defined, otherwise use `~/.openclaw/skills/` ### Local installation (default) - When the user does NOT mention "global" or similar words: - Install to: `{current_workspace}/skills/` - If no workspace is detected, default to `~/.openclaw/workspace/skills/` ## Workflow ### Mode A: Search Only (no installation) When user only asks to "search", "find", or "look for" a skill (no download/install intent): 1. **Detect search intent** — User asks "find X skill", "search for Y", "is there a skill that can..." 2. **Search all sources simultaneously** — Fire all available search channels in parallel, then aggregate results: **ClawHub** (primary): ```bash clawhub search "" ``` **GitHub anthropics/skills** (parallel): ```bash curl -s "https://api.github.com/repos/anthropics/skills/contents/skills?ref=main" \ | grep -i "" ``` **skills.sh** (parallel search only): ```bash npx skills find "" ``` Note: Install always uses file-based workflow (not `npx skills add`) for directory control. Aggregate all results into one unified table, with source clearly labeled per skill. 3. **Achieve information completeness** — Attempt `clawhub inspect` for each candidate skill. If inspect fails: - Enter degraded mode (see "Search degraded mode" above) - Do not proceed to recommendation without user consent 4. **Present results** — Show all results in one unified comparison table. Each row must clearly show which source the skill came from. Include: - **Source** (ClawHub / GitHub / skills.sh) — always show this - Skill name and owner/repo - Short description - Source URL - Popularity or ranking signals (install count, search score, stars, recency, or source quality) — mark `unknown` if unavailable - Best-use-case recommendation for each result - A final overall recommendation **only** when all critical fields are available 5. **Disclose information level** — Label the table with its completeness level: - Full: "✅ Full details available" - Partial: "⚠️ Partial information — some fields marked `unknown`" - Minimal: "❌ Limited details — recommend waiting for full data before deciding" 6. **Wait for user** — Ask if they want to install any of the results, or wait for full data 7. **If yes** → Continue to Mode B (Installation) 8. **Done** — End here if user just wants to browse ### Mode B: Installation (review + approved install) Use the official ClawHub installation workflow for ClawHub-hosted skills whenever the `clawhub` CLI is available. Use the transparent fallback workflow only when the official ClawHub workflow is unavailable or when the source is outside ClawHub. 1. **Capture request** - Extract the skill name to download - Check if user requested global installation - Confirm this is an explicit download request (if not, ask for confirmation) - **Check existing installation**: - For global installation: check if skill already exists at `~/.openclaw/skills//` - For local installation: check if skill already exists at `{current_workspace}/skills//` - If skill already exists: inform the user the skill is already installed, ask whether they want to **update** it to the latest version, then proceed accordingly 2. **Find the skill** - For `clawhub.ai` source: `clawhub search ""` then `clawhub inspect ` - For `github.com/anthropics/skills`: ```bash curl -s "https://raw.githubusercontent.com/anthropics/skills/main/skills//SKILL.md" ``` - For `skills.sh`: use file-based install (download from the skill's GitHub URL, not `npx skills add`) - Search in priority order (ClawHub first). If not found, try GitHub. If still not found, ask for a URL. - If multiple matching skills found: organize information (name, description, popularity, source) and recommend → wait for user selection - If not found: inform user, suggest alternative sources, wait for user-provided URL 3. **Internal sensitive content check** - For the transparent file installation workflow: download to a unique per-run temporary location and do not use symlink-based installation - After downloading to a temporary location, automatically read text files to check for suspicious or unsafe content - Look for patterns such as unwanted private data collection, destructive commands, hidden execution paths, or suspicious obfuscation - If suspicious content is detected: delete the download, inform user of the specific issues, stop - If no suspicious content is found: proceed to installation - If the official `clawhub` workflow is available for a ClawHub-hosted skill, prefer `clawhub inspect` before `clawhub install` - If additional third-party safety tools are available and the user wants extra checks, run them as an extra verification layer after the baseline manual review 4. **Install / Update** - If the selected skill is hosted on ClawHub and `clawhub` CLI is available: - For inspection: use `clawhub inspect ` - For global install: use `clawhub install --dir ~/.openclaw/skills` - For local install: use `clawhub install --dir {current_workspace}/skills` - For updates, prefer the official ClawHub update/install workflow instead of a custom copy-based update flow - Otherwise, use the transparent file installation workflow: - Create the target directory if it doesn't exist - If updating existing skill: - Backup old version to target directory with `.bak` suffix (e.g. `skill-name.bak.`) - **Preserve skill-generated data**: - Keep all non-source files that are not part of the original download (e.g. cached data, user configuration, generated outputs) - Only delete/overwrite files that exist in the new downloaded version - Do not delete empty directories or directories that contain user data - Copy the full source files from temp to target directory (**do NOT use symlinks**) - Overwrite only existing source files, leave untouched any additional user/data files - Verify the skill structure (ensures SKILL.md exists) - If updated: inform user that the update is complete, mention the backup location and that existing user data has been preserved - If installed: inform user of successful new installation: - Where it was installed - How to use it - Any additional setup required 5. **Cleanup** - Remove the unique per-run temporary working directory and any temporary download files created for that run 6. **Post-installation prompt** - After successful installation/update and cleanup, ask the user: "Would you like me to explain the functions and usage of this new skill for you?" - If user agrees, read the skill's SKILL.md and summarize the core functions, usage flow and key notes to the user 7. **Done** ## Adding new sources Users can add new trusted sources by appending to the *Trusted download sources* list above. Maintain the numbered order.## Examples **Example 1: Full information search (recommended)** > User: Find me a weather skill - `clawhub search weather` → results found - `clawhub inspect weather-skill` → all fields returned - Present as "✅ Full details available" table with recommendation **Example 2: Partial information (rate limited)** > User: Find me a stock skill - `clawhub search stock` → results found - `clawhub inspect stock-monitor` → Rate limit exceeded - Show table with available fields, mark missing as `unknown` - Label table as "⚠️ Partial information — install count and last updated are unknown" - Do NOT give recommendation; ask user: "Proceed with partial info, or wait ~30s and retry?" **Example 3: Global install** > User: Download the weather skill globally - Skill name: `weather` - Install path: `~/.openclaw/skills/weather` - Run security checks → install **Example 4: Local install** > User: Can you install skill-creator in this workspace - Skill name: `skill-creator` - Install path: `./skills/skill-creator` - Run security checks → install **Example 5: Not found** > User: Download my-custom-skill - Not found in default sources → "I couldn't find 'my-custom-skill' in the default trusted sources. Can you provide a download URL?" **Example 6: Uncertain request** > User: Where can I find a good markdown processing skill? - "You can find skills on https://clawhub.ai/, https://skills.sh/, or https://github.com/anthropics/skills. Would you like me to search for and download a markdown processing skill?"