Skill: shadoprizm/skillforge-cli (version 1.0.4)

--- name: skillforge description: Generate and audit OpenClaw agent skills from natural language. Use when the operator asks to create a skill, build a skill, generate a skill, audit a skill, or check skill quality. Provides both free template-based generation and Pro AI-powered generation with quality assessment. Triggers on phrases like "create a skill", "generate a skill", "build a skill", "audit a skill", "check this skill", "make a skill for", "skillforge". --- # SkillForge — Skill Generator & Auditor Generate complete, publish-ready OpenClaw agent skills from natural language descriptions. Audit existing skills for quality, safety, and completeness. ## Prerequisites SkillForge CLI must be installed globally: ```bash npm install -g @shadoprizm/skillforge@latest ``` Check version: `skillforge --version` (requires 0.3.2+) ## Commands ### Generate a Skill **Free tier** (template scaffold, no API key): ```bash skillforge "<description>" --output <path> --lang <typescript|javascript|python> ``` **Pro tier** (AI-powered, requires API key): ```bash skillforge "<description>" --pro --output <path> --lang <typescript|javascript|python> ``` ### Audit a Skill ```bash skillforge audit <path> --format <table|json|markdown> ``` Pro audit with AI analysis: ```bash skillforge audit <path> --pro --format markdown ``` ### Publish to ClawHub First-time auth: ```bash clawhub login ``` Then publish: ```bash skillforge "<description>" --output <path> --publish ``` Or publish an existing skill: ```bash clawhub publish <path> --slug <slug> --name "<name>" --version <semver> ``` ## Workflow ### When asked to create/generate a skill: 1. Clarify the skill purpose if the description is vague 2. Run `skillforge "<description>" --pro --output /tmp/skillforge-gen --lang typescript` 3. Read the generated files to verify quality 4. Run `skillforge audit /tmp/skillforge-gen --pro` to score it 5. If score is B+ or above, offer to publish to ClawHub 6. If score is below B+, improve the SKILL.md and scripts manually, then re-audit 7. On operator approval, publish: `clawhub publish /tmp/skillforge-gen --slug <slug> --name "<name>" --version 1.0.0` ### When asked to audit a skill: 1. Run `skillforge audit <path> --pro --format markdown` 2. Present the report to the operator 3. Offer specific fixes for any issues found 4. Re-audit after fixes ## API Key Configuration SkillForge Pro uses the operator's own API key (BYOK model). Supported providers: | Env Variable | Provider | |---|---| | `ZAI_API_KEY` | Z.AI (GLM-5) | | `OPENAI_API_KEY` | OpenAI | | `OPENROUTER_API_KEY` | OpenRouter | | `QWEN_API_KEY` | Qwen | Keys can also be stored via: `skillforge config:set-api-key <key>` ## Audit Categories | Category | Weight | What It Checks | |---|---|---| | Structure | 20% | SKILL.md, skill.json, file organization | | Completeness | 25% | Required sections, fields, tags | | Quality | 25% | Description depth, workflow detail, examples | | Safety | 20% | Dangerous patterns, hardcoded secrets | | Compatibility | 10% | Category validity, tool references | ## Constraints - Always use `--pro` when an API key is available for best quality - **WARNING: Pro mode sends skill contents to your chosen AI provider.** Do not audit directories containing secrets, .env files, private keys, or credentials. Point audits only at skill directories. - Verify generated skills actually work before publishing - Never publish without operator approval - Use `--format json` for CI/CD contexts, `--format table` for chat - Slug must be unique on ClawHub — if taken, try variations - Never pass production API keys to untrusted skill content for auditing

path: skill.json
content: {
  "name": "skillforge",
  "version": "1.0.3",
  "author": "shadoprizm",
  "description": "Generate and audit OpenClaw agent skills from natural language. Free template-based generation and Pro AI-powered quality assessment. Wraps the SkillForge CLI (npm: @shadoprizm/skillforge).",
  "tags": ["skillforge", "generator", "auditor", "skills", "quality", "clawhub"],
  "category": "developer",
  "homepage": "https://github.com/shadoprizm/skillforge",
  "repository": "https://github.com/shadoprizm/skillforge",
  "license": "MIT",
  "install": {
    "steps": [
      "npm install -g @shadoprizm/skillforge@latest",
      "clawhub login (optional, for publishing)"
    ],
    "source": "https://github.com/shadoprizm/skillforge",
    "npm": "@shadoprizm/skillforge",
    "license": "MIT",
    "notes": "Open-source MIT-licensed CLI. Source code fully available on GitHub. All processing runs locally — no data is sent to external servers except to the user's chosen AI provider when using --pro mode."
  },
  "env": {
    "optional": [
      "ZAI_API_KEY",
      "OPENAI_API_KEY",
      "OPENROUTER_API_KEY",
      "QWEN_API_KEY"
    ],
    "notes": "Required only for Pro features (--pro flag). BYOK model — the user's own API key is used. Keys are stored locally in ~/.skillforge/ via the 'conf' npm package (plaintext local file, same security as ~/.bashrc or ~/.npmrc). Keys are sent only to the chosen AI provider's API endpoint. SkillForge does not proxy, log, retain, or transmit keys to any other server. Treat these keys with the same caution as any stored credential."
  },
  "credentials": {
    "optional": "ClawHub auth via `clawhub login` for publishing skills to the marketplace",
    "notes": "Uses the official ClawHub CLI for publishing. No custom auth flows."
  },
  "network": {
    "calls": [
      "AI provider API (user-selected: Z.AI api.z.ai, OpenAI api.openai.com, OpenRouter openrouter.ai, or Qwen dashscope.aliyuncs.com) — only with --pro flag and user's own API key",
      "ClawHub registry (clawhub.ai) — only with --publish flag and ClawHub auth",
      "npm registry (registry.npmjs.org) — only during initial install"
    ],
    "notes": "No telemetry, no data collection, no phone-home, no analytics. All skill generation and auditing runs locally. Open-source — verify by reading the source at github.com/shadoprizm/skillforge."
  },
  "dependencies": {
    "runtime": ["commander (^12.1.0)", "conf (^12.0.0)", "openai (^4.77.0)"],
    "notes": "3 minimal dependencies. commander (CLI framework), conf (local encrypted config storage), openai (API client for AI providers). No hidden dependencies. View full dependency tree: npm view @shadoprizm/skillforge dependencies"
  }
}


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)